WordPress Plugin Vulnerabilities

Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

Description

The plugin does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary plugin options, including the shared secret that guards its own privileged endpoints.

Proof of Concept

Affects Plugins

Plugin icon
social-web-suite
No known fix

References

CVE
CVE-2026-88931

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
e1341110-abad-47f5-aed5-1c06cb0c8071

Timeline

Publicly Published
2026-10-06 (about 2 days ago)
Added
2026-09-29 (about 9 days ago)
Last Updated
2026-09-29 (about 9 days ago)

Other

Published
Title
Published
2026-01-08
Title
WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush
Published
2026-08-11
Title
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin < 2.23.2 - Missing Authorization
Published
2025-09-22
Title
Lazy Blocks < 4.1.1 - Missing Authorization
Published
2024-12-17
Title
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 7.8.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Published
2026-07-01
Title
Flatsome <= 3.20.5 - Missing Authorization