What’s Vulnerable › Vulnerabilities
CVE-2026-88931: Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-09 · updated 2026-10-09
- Weakness: CWE-862
Description
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.
Affected products
- Social Web Suite: through 4.1.12
References
Get alerted when CVE-2026-88931 or the next vulnerability affects your stack