CVE-2026-88930

HIGHCVSS 8.6

Description

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.

Timeline

Published:October 11th, 2026 7:17 AM

Last modified:October 11th, 2026 12:17 PM

CVSS Scoring

CVSS v3: 8.6 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-89

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/79204810-fd42-479d-bd2f-8762210f0fc5/

Source: NIST NVD · Data may lag official sources by up to one minute