CVE-2026-11977

🗓️ 05 Aug 2026 07:39:24Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 72 Views🌐 WEB

Authenticated authors can exploit structured query language injection via wpma_metabox_authors_list when an admin loads the post list.

Reporter	Title	Published	Views	Family All 8
attackerkb	CVE-2026-11977	5 Aug 202607:39	–	attackerkb
Cvelist	CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection	5 Aug 202607:39	–	cvelist
EUVD	EUVD-2026-53288	5 Aug 202607:39	–	euvd
NVD	CVE-2026-11977	5 Aug 202608:16	–	nvd
Patchstack	WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin <= 3.9.1 - Authenticated (Author+) SQL Injection vulnerability	4 Aug 202619:33	–	patchstack
Positive Technologies	PT-2026-68060	5 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-11977: Improper Neutralization of Special Elements used in an SQL Command	5 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection	5 Aug 202607:39	–	vulnrichment

Vulners

Node

afthemes wp_post_authorRange≤3.9.1wordpress

[
  {
    "vendor": "afthemes",
    "product": "WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.9.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ca5cb925-6f95-4f81-92d0-5f3c8e5f7d59
plugins	www.plugins.trac.wordpress.org/browser/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php
plugins	www.plugins.trac.wordpress.org/browser/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php
plugins	www.plugins.trac.wordpress.org/browser/wp-post-author/trunk/includes/multi-authors/wpa-multi-authors.php

Parameter	Position	Path	Description	CWE
wpma_metabox_authors_list	path	wp-admin/edit.php	SQL Injection via wpma_metabox_authors_list parameter in WP Post Author plugin; can extract data when admin loads the post list at /wp-admin/edit.php.	CWE-89

12 Aug 2026 21:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.5

EPSS0.00413

SSVC

CWE-89