CVE-2026-97227
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the plugin's configuration.
Risk Assessment
This can lead to leakage of sensitive credentials, content loss, and disruption of the plugin's functionality.
Recommendation
It is recommended to update the plugin to version 4.4.8 or later and review permissions of users with access to posting features.
Other vulnerabilities in NextScripts: Social Networks Auto-Poster
Original NVD description (English source)
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS