An SQL Injection flaw exists in the WP Post Author plugin that improperly neutralizes special characters in SQL commands. The vulnerability allows a blind SQL injection, enabling an attacker with web access to retrieve, modify, or delete data from the WordPress database. This can compromise the confidentiality, integrity, and availability of the site’s content and user information.

All installations of the WP Post Author plugin by AF themes, versions up to and including 4.0.0, are affected. The flaw is present in every release from the initial release through the 4.0.0 version, making any WordPress site that uses this plugin vulnerable until it is updated beyond 4.0.0.

The CVSS score of 7.6 indicates high severity, but the EPSS score is unavailable, so the current exploitation probability cannot be quantified. The vulnerability is accessible remotely via the web interface; a malicious actor can send crafted requests to the plugin’s endpoints to inject and execute SQL statements. As the flaw is a blind injection, an attacker requires knowledge of the database schema and must observe query error messages or use timing-based techniques to extract data, yet once compromised the attacker could gain full control over the database.