The WP Post Author plugin, before version 4.2.0, fails to verify that a user account has been created before allowing its profile to be updated during front‑end registration. This flaw lets unauthenticated users overwrite the display name, nickname, and website fields of the first account, which is normally the administrator. Such unauthorized changes compromise the integrity of the administrator account, but do not provide direct code execution or elevated privileges beyond altering user metadata.

WordPress sites using the WP Post Author plugin version 4.1.x or earlier are affected. The vulnerability targets the first registered user account, typically the site administrator.

No CVSS or EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated front‑end registration form that submits the vulnerable fields. An adversary can craft a registration request that includes tweaked display name, nickname, or website values, causing the plugin to write those values to the administrator profile. The exploitation requires only HTTP access to the registration endpoint and no additional credentials.