CVE-2026-88931

MediumCVSS 5.3

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint. Attackers can overwrite arbitrary plugin options, including the shared secret that guards its own privileged endpoints.

Risk Assessment

Allows an unauthenticated attacker to take control of the plugin's configuration and access its privileged functions, potentially leading to further site compromise.

Recommendation

Update the Social Web Suite plugin to a version newer than 4.1.12 if available. Until then, consider disabling the plugin.

Other vulnerabilities in Social Web Suite WordPress plugin

CVE-2026-88930High
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Original NVD description (English source)

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS