An Author-level account is a WordPress role designed for ordinary publishing work. By default, it can create and publish posts and often has the upload_files capability, which lets the user add media to the site. This is important in security because a role that looks low-privilege can still interact with server-side processing features that handle user-uploaded content.
In attacks, that matters when uploads are passed to parsers, converters, or image tools. A malicious file may be uploaded by an authenticated Author and then processed by software that interprets the file in an unsafe way, turning a content action into code execution or file abuse. Defenders should treat Author permissions as part of the attack surface: remove upload rights where they are not needed, restrict dangerous file types, isolate media processing, and keep WordPress and related tooling patched.