CVE-2026-88931: Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
Installations running Social Web Suite WordPress plugin version 4.1.12 or earlier are affected if the vulnerable unauthenticated endpoint is reachable.
What does an attacker need to exploit this issue?
The vulnerable settings update endpoint is unauthenticated, so the issue does not require a WordPress account or prior access. An attacker can overwrite Social Web Suite plugin options, including the shared secret used to protect privileged endpoints.
How can defenders determine whether they may already be affected?
Review the installed Social Web Suite plugin version and inspect its settings for unexpected changes, particularly the shared secret that guards privileged endpoints. The provided information does not identify specific indicators or logs for confirmed exploitation.