The WP Post Author plugin by AF themes suffers from an SQL Injection vulnerability (CVE-2024-56247) due to improper neutralization of special elements in SQL commands. This allows an attacker with high privileges to execute crafted SQL queries that can compromise confidentiality and availability of the affected system. The vulnerability affects all versions up to 3.8.2. The CVSS 3.1 base score is 7.6 (high), with network attack vector, low attack complexity, high privileges required, no user interaction, and scope changed. No patch or vendor advisory is currently available.

Successful exploitation could lead to unauthorized disclosure of sensitive information (confidentiality impact) and partial denial of service or resource disruption (availability impact). Integrity is not impacted according to the CVSS vector. The attack requires high privileges, limiting the attack surface to privileged users or administrators. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to privileged accounts and monitor for suspicious activity related to the WP Post Author plugin. Avoid granting unnecessary high privileges to users. Follow vendor channels for updates and apply patches promptly once available.