CVE-2026-108685

18th percentile - higher than 18% of all known CVEs

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.

An attacker can alter the administrator's profile data, potentially leading to impersonation, phishing, or further social engineering attacks. This can also undermine trust in the site.

Update the WP Post Author plugin to version 4.2.0 or later. Check the administrator profile data for unauthorized changes.