The WP Post Author plugin for WordPress suffers from a time-based SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of proper preparation of the linked_user_id parameter in SQL queries. Authenticated attackers with Administrator-level access can exploit this to append malicious SQL queries, potentially extracting sensitive data from the database. This affects all plugin versions up to and including 3.8.1. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with Administrator privileges to execute arbitrary SQL commands via the linked_user_id parameter, leading to potential disclosure of sensitive information, modification of data, and disruption of service. The vulnerability compromises confidentiality, integrity, and availability of the affected WordPress site's database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the linked_user_id parameter. Avoid using vulnerable plugin versions and consider disabling the plugin if possible.