CVE-2026-11977 Overview
CVE-2026-11977 is a SQL Injection vulnerability [CWE-89] affecting the WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress. The flaw exists in all versions up to and including 3.9.1. Insufficient escaping of the wpma_metabox_authors_list parameter combined with unprepared SQL queries allows authenticated attackers with author-level access to append arbitrary SQL to existing queries. Exploitation follows a stored, two-step chain: an attacker persists a crafted guest-author token during post creation, then the injection triggers when any administrator loads the post list at /wp-admin/edit.php. The injected result renders in the Authors column, enabling extraction of sensitive database contents.
Critical Impact
Authenticated authors can extract WordPress database contents, including password hashes and secret keys, once an administrator loads the affected post list screen.
Affected Products
- WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress
- All versions up to and including 3.9.1
- Sites permitting author-level or higher user registration
Discovery Timeline
- 2026-08-05 - CVE-2026-11977 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-11977
Vulnerability Analysis
The vulnerability resides in the plugin's multi-author handling logic within includes/multi-authors/wpa-multi-authors.php. The plugin accepts the wpma_metabox_authors_list parameter during post save operations and stores the value as post metadata. When the WordPress admin edit screen renders the Authors column for each post, the stored value is concatenated into a SQL query without proper preparation or escaping. Attackers exploit this by embedding SQL fragments inside the guest-author token, which the plugin persists verbatim and later executes.
Because the vulnerable code path runs when administrators browse /wp-admin/edit.php, the injection is second-order and stored. This grants the attacker read access to arbitrary tables in the WordPress database, including wp_users credential hashes and application secrets stored in wp_options.
Root Cause
The root cause is a failure to use parameterized queries via $wpdb->prepare() when constructing the query that resolves author tokens for the post list column. The plugin trusts the previously stored wpma_metabox_authors_list value as safe, but that value originates from user-controlled POST data submitted during post creation or editing. There is no server-side allowlist validation of the token format before it is stored or before it is interpolated into SQL.
Attack Vector
Exploitation requires an authenticated account with the author role or higher. The attacker crafts a post and submits a malicious wpma_metabox_authors_list payload containing SQL syntax that breaks out of the intended query context. The payload persists as post metadata. When an administrator later opens the standard posts listing screen, the plugin executes the tainted query and displays the resulting data in the Authors column, yielding the injected output directly in the browser. See the Wordfence Vulnerability Analysis and the affected WordPress Plugin Code Snippet for the vulnerable functions.
Detection Methods for CVE-2026-11977
Indicators of Compromise
- Post meta entries for wpma_metabox_authors_list containing SQL syntax characters such as UNION, SELECT, --, /*, or single quotes.
- Unexpected strings rendered in the Authors column on /wp-admin/edit.php, including database values, user emails, or password hash fragments.
- Web server access logs showing POST requests to post.php or post-new.php from author-level accounts followed by administrator access to edit.php.
- Newly registered author-level accounts on sites that do not normally accept contributor submissions.
Detection Strategies
- Query the wp_postmeta table for rows where meta_key = 'wpma_metabox_authors_list' and meta_value contains SQL keywords or comment sequences.
- Enable WordPress database query logging or a Web Application Firewall (WAF) rule inspecting the wpma_metabox_authors_list parameter for injection patterns.
- Alert on outbound requests or unusual database response sizes triggered by admin sessions loading the post list.
Monitoring Recommendations
- Monitor administrator sessions for anomalous rendering delays on /wp-admin/edit.php, which can indicate injected SLEEP() or heavy UNION queries.
- Audit author-role account creation and privilege changes on WordPress installations running the affected plugin.
- Track file integrity for wp-post-author/includes/multi-authors/wpa-multi-authors.php against the vendor-supplied patched version.
How to Mitigate CVE-2026-11977
Immediate Actions Required
- Update the WP Post Author plugin to a version later than 3.9.1 that contains the fix from the WordPress Changeset Update.
- Audit all existing wpma_metabox_authors_list post meta values and remove entries containing SQL syntax.
- Rotate WordPress secret keys, salts, and administrator passwords if injection artifacts are present.
- Review author-level user accounts and disable any that were created without justification.
Patch Information
The vendor addressed the vulnerability by replacing string concatenation with prepared statements using $wpdb->prepare() in the affected code paths. Review the fix in the WordPress Changeset Update and confirm the deployed plugin version reflects those changes.
Workarounds
- Deactivate the WP Post Author plugin until patching is complete.
- Restrict post creation and editing capabilities so that only trusted editors and administrators can submit content.
- Deploy a WAF rule blocking POST parameters named wpma_metabox_authors_list that contain SQL metacharacters such as quotes, semicolons, or comment sequences.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
