wp_post_author vulnerabilities
CVEs whose affected-version data names the wp_post_author package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108686Low· 3.7WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
▾ SunlitEPSS 0.22%via CVEORG
CVE-2026-108685Low· 3.7WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website o…
▾ SunlitEPSS 0.26%via CVEORG