CVE-2026-11977 medium

Description

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step chain: an attacker first saves a crafted guest-author token via the wpma_metabox_authors_list parameter during post creation or editing, then triggers the injection when any admin user loads the post list screen at /wp-admin/edit.php, causing the injected SQL result to be rendered in the Authors column. Affected software — plugin: WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars (affected: *-3.9.1). CVSS 6.5 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• CVE record: CVE-2026-11977 Wordfence
• Wordfence vulnerability detail Wordfence
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5cb925-6f95-4f81-92d0-5f3c8e5f7d59?source=api-prod Wordfence

• Microsoft patches 622 flaws, restricts Kerberos RC4 | Cybernews
  web:cybernews.com

  Microsoft's July 2026 Patch Tuesday fixes a record 622 vulnerabilities and begins mandatory Kerberos RC4 enforcement, marking one of Windows' biggest security updates.

  2026-08-05 02:15 UTC
• Nvd - Cve-2026-17797
  web:nvd.nist.gov

  NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

  2026-08-05 02:15 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-08-05 02:15 UTC
• SAP Security Patch Day - June 2026
  web:support.sap.com

  SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 9th of June 2026 , SAP security patch day saw the release of 15 new security notes.

  2026-08-05 02:15 UTC
• Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 ...
  web:techcommunity.microsoft.com

  Hi team, Our organization has successfully implemented the recommended mitigation for CVE - 2026 -42897. However, we are currently experiencing the documented known issues within our environment. Could the Exchange team kindly provide a tentative timeline or ETA for a permanent security update that resolves the underlying vulnerability while addressing these known issues? We would greatly ...

  2026-08-05 02:15 UTC
• Released: June 2026 Exchange Server Security Updates
  web:techcommunity.microsoft.com

  Are those solved in the CVE - 2026 -42897 fix (June 2026 SU)? Yes, when June 2026 SU is installed and mitigation is removed, known issues should be resolved too. But note that mitigations do not get removed automatically after installation of the SU (and we recommend that you keep then enabled for a little while longer).

  2026-08-05 02:15 UTC
• Update Chrome now: Critical bugs could let attackers run code
  web:www.malwarebytes.com

  This Chrome update fixes critical flaws attackers could exploit through malicious websites, but not the "Browser Fetch" vulnerability.

  2026-08-05 02:15 UTC
• National Vulnerability Database | NIST
  web:www.nist.gov

  NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.

  2026-08-05 02:15 UTC
• Wordfence remediation: WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
  Wordfence

  Update to version 3.10.0, or a newer patched version

  2026-08-05 02:15 UTC

Only Available for Registered Users. Sign in to view.