CVE-2026-57643 is a SQL Injection vulnerability in the AF themes WP Post Author plugin affecting versions up to and including 3.9.1. The flaw arises from improper neutralization of special elements in SQL commands, allowing a contributor-level user to execute unauthorized SQL queries. The vulnerability has a CVSS 3.1 base score of 8.5, reflecting high impact on confidentiality and some impact on availability, with a low attack complexity and no user interaction required. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact) and partial denial of service (availability impact). Integrity impact is not indicated. The vulnerability affects the confidentiality of the database and may cause limited availability issues.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and monitor for suspicious activity related to the WP Post Author plugin. Avoid granting unnecessary privileges to contributors to reduce risk.