CVE-2026-108124: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

This vulnerability in wp-post-author prior to version 4.1.0 is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands (SQL injection). The CVSS 3.1 score is 4.9 (medium severity) with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and unchanged scope. The impact is high on confidentiality but no impact on integrity or availability. No known exploits are reported in the wild, and no patch or vendor advisory information is provided.

An attacker with high privileges could exploit this SQL injection vulnerability to access or disclose sensitive information (high confidentiality impact). There is no impact on data integrity or system availability. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Restricting high privilege access and following least privilege principles may reduce risk until a fix is available.