CVE-2026-39787: WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
Affected Software
1 affected component
10web Social Photo Feed<=1.4.35
Event History
Oct 6, 2026
CVE Published
via MITRE·08:34 AM
Data Sourced
via MITRE·08:34 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges to attempt exploitation over the network.
2
Which plugin versions are affected?
10Web Social Photo Feed versions 1.4.35 and earlier are identified as affected.
3
What is the potential impact?
The provided severity vector indicates potential low-impact confidentiality and integrity effects, with no indicated availability impact.