CVE-2026-88931

Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.

Affected

Social Web Suite

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 8th percentile

Published

2026-10-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/e1341110-abad-47f5-aed5-1c06cb0c8071/

References

• CVE Record
• NVD entry