CVE-2026-108124CWE-89sql-injection

CVE-2026-108124

Medium · published October 9, 2026

CVSS v3.1

4.9

EPSS

Percentile

13.7

In the wild

Unconfirmed

What it is

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.

This issue affects wp-post-author before 4.1.0.

The record

Technical detail

CVSS v3.1: 4.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00236 · 13.7th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-10-09T19:17Z

References (1)

EPSS history

Timeline