Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N C H N L 7.6 — — —
AFFECTED Product Versions Fixed WP Post Author unspecified 4.0.1
TIMELINE Apr 29 Reserved by Patchstack Oct 7 PATCH SHIPPED — CVE-2026-42708 (AF themes WP Post Author). Fixed in WP Post Author 4.0.1. Oct 7 Published (CNA: Patchstack)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
| Date | Event | Detail |
|---|---|---|
| April 29, 2026 | Reserved | Reserved by Patchstack |
| October 7, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-42708 (AF themes WP Post Author). Fixed in WP Post Author 4.0.1. |
| October 7, 2026 | Published | Published (CNA: Patchstack) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| AF themes | WP Post Author | — | — | 4.0.1 |
Authoritative record: CVE-2026-42708 at cve.org
Vendors: af themes
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-42708 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
