CVE-2026-93904: Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'excludeposts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The HMAC authentication gate protecting the endpoint is bypassable on any freshly activated installation where an administrator has not yet visited the settings page, because the secretkey option remains empty until lazily generated at that point, allowing an attacker to compute a valid token using hashhmac('sha256', '', $timestamp) with any chosen timestamp.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed without prior authentication?
Freshly activated installations are exposed if an administrator has not yet visited the plugin settings page. In that state, the secret_key option remains empty, allowing an unauthenticated attacker to generate a valid HMAC token.
What does an attacker need to exploit the issue?
The attacker needs network access to the vulnerable endpoint and can use the exclude_posts parameter to append SQL to an existing query. No account or user interaction is required on affected freshly activated installations with an empty secret key.
What is the potential impact of successful exploitation?
An attacker can extract sensitive information from the WordPress database. The provided impact information indicates confidentiality impact without integrity or availability impact.
How can administrators determine whether their installation has the bypass condition?
The bypass condition exists when the plugin was freshly activated and no administrator has visited its settings page, leaving the secret_key option empty. Visiting the settings page causes the key to be lazily generated, according to the provided description.