CVE-2026-108685
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 29, 2026
Vendor
unknown
Description
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.