[ CVE-2026-88930 · Published 11 Oct 2026 ]
Vulnerability in Unknown Social Web Suite
CVSS 8.6
EPSS <1%No fix listed yet
[ Description ]Official description
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.