CVE-2026-88930

HighCVSS 8.6

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Risk Assessment

SQL injection attacks can lead to unauthorized database access, data theft, or complete takeover of the WordPress site.

Recommendation

Update the Social Web Suite plugin to the latest available version that includes security fixes. If not available, consider temporarily disabling the plugin until a patch is released.

Other vulnerabilities in Social Web Suite WordPress plugin

CVE-2026-88931Medium
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint. Attackers can overwrite arbitrary plugin options, including the shared secret that guards its own privileged endpoints.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS