Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WP Post Author 4.2.0 Clear all filters
TI-2026-82294 CVE-2026-108686 · GHSA-9288-h947-8qw5

Unauthenticated reCAPTCHA secret key leak in WP Post Author plugin

Priority LOW 17

The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00216 Published 2026-10-29 Fixed in 4.2.0 CWE-200
TI-2026-82293 CVE-2026-108685 · GHSA-p922-mx52-2wrj

WP Post Author lets visitors overwrite the first user's profile

Priority LOW 17

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickna…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00259 Published 2026-10-29 Fixed in 4.2.0 CWE-862