CVE-2026-11977 is a SQL Injection vulnerability in the WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars WordPress plugin. The flaw exists due to insufficient escaping and lack of proper preparation of the 'wpma_metabox_authors_list' parameter in SQL queries. Authenticated attackers with author-level privileges can inject additional SQL queries by saving a crafted guest-author token during post creation or editing. The injection is triggered when an admin loads the post list screen, causing the malicious SQL to execute and potentially disclose sensitive information from the database.

An attacker with author-level access or higher can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands. The vulnerability does not affect data integrity or availability but compromises confidentiality by exposing sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to post creation and editing. Avoid loading the post list screen in the admin interface if suspicious activity is suspected.