WP Post Author vulnerabilities

The WP Post Author plugin by AF themes contains a blind SQL injection vulnerability. The issue affects versions up to and including 4.0.0.

The WP Post Author plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to and including 3.9.1. Authenticated attackers with author-level access can append additional SQL queries to extract sensitive information from the database. Exploitation is a two-step chain involving saving a crafted guest-author token and triggering the injection when an admin loads the post list screen.

The WP Post Author plugin version 3.9.1 and earlier contains a SQL injection vulnerability in the Contributor function. This allows an attacker to manipulate database queries.