CVE-2026-108685

LowCVSS 3.7/10Last modified Oct 29, 2026

Description

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	WP Post Author	< 4.2.0

References

https://wpscan.com/vulnerability/605832f7-40d5-4a74-a30a-5f5f2906db63/

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1086863.7The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticate CVE-2026-1086884.3Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privi CVE-2026-1086895.4Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI c CVE-2026-1086904.3mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items d CVE-2026-1086915.4mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers'CVE-2026-1086926.51Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source dat CVE-2026-1086937.8ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches CVE-2026-1086946.5ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/conve CVE-2026-1086957.1MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketp CVE-2026-1086964.3CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on o CVE-2026-1086974.3CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restric CVE-2026-1086986.5hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign sign