CVE-2025-26886 describes an SQL Injection vulnerability in the PublishPress Authors plugin for WordPress, affecting versions up to 4.7.3. The issue stems from improper neutralization of special elements in SQL commands, which can be exploited by an attacker with high privileges to execute SQL queries that compromise confidentiality. The CVSS 3.1 base score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating network attack vector, low attack complexity, required high privileges, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

An attacker with high privileges on the affected system could exploit this vulnerability to execute unauthorized SQL commands, leading to a high confidentiality impact. This could result in exposure of sensitive data stored in the database. The integrity impact is not affected, and availability impact is low. No known exploits in the wild have been reported, so the immediate risk may be limited but remains significant due to the nature of SQL Injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the PublishPress Authors plugin and monitor for suspicious activity related to SQL queries. Avoid exposing administrative interfaces to untrusted networks. Apply security best practices for WordPress plugins and consider disabling or removing the plugin if it is not essential.