What is the CVSS score of CVE-2026-12002?

CVE-2026-12002 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Social Photo Feed CVE-2026-12002

EUVD-2026-42230 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-08 Wordfence

GHSA-gwh5-3rc2-hm72

WordPress CSRF Wordpress Plugin Smash Balloon Social Photo Feed Easy Social Feeds Plugin Smub

4.7

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

vuln.today AI

4.7 MEDIUM

AV:N and PR:N reflect unauthenticated network delivery; UI:R captures mandatory admin interaction; S:C and I:L reflect integrity impact on external Meta API tokens only.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 13:24 vuln.today

CVE Published

Jul 08, 2026 - 12:33 nvd

MEDIUM 4.7

DescriptionCVE.org

The Smash Balloon Social Photo Feed - Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in Smash Balloon Social Photo Feed - Easy Social Feeds Plugin for WordPress (all versions through 6.11.1) enables unauthenticated remote attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by forging a request that a logged-in administrator unwittingly executes. The root cause is missing or incorrect nonce validation on the maybe_connection_data function, WordPress's primary CSRF defense mechanism. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a patch changeset is confirmed in the WordPress plugin repository.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises when a server-side function performs a state-changing action without verifying that the HTTP request originated from the legitimate application session rather than a third-party site. WordPress mitigates CSRF through nonce tokens embedded in forms and verified server-side; the maybe_connection_data function in the plugin's admin layer omits this check entirely. The affected component manages oEmbed credential storage for Instagram and Facebook API integrations, meaning successful exploitation modifies externally-scoped API tokens - reflected in the CVSS S:C (Scope Changed) designation. CPE cpe:2.3:a:smub:smash_balloon_social_photo_feed_-_easy_social_feeds_plugin:*:*:*:*:*:*:*:* confirms all versioned releases of the plugin are affected up to 6.11.1. The fix is localized to instagram-feed/trunk/admin/SBI_oEmbeds.php per WordPress Trac changeset 3575933.

RemediationAI

Update the Smash Balloon Social Photo Feed - Easy Social Feeds Plugin to a version above 6.11.1 - an upstream fix is confirmed in WordPress Trac changeset 3575933 targeting instagram-feed/trunk/admin/SBI_oEmbeds.php (https://plugins.trac.wordpress.org/changeset/3575933/instagram-feed/trunk/admin/SBI_oEmbeds.php); however, the exact version number of the released patched plugin has not been independently confirmed from available data, so verify the current stable release in the WordPress plugin directory. Until the patch is applied, administrators should avoid clicking unsolicited links while logged into WordPress, and should consider restricting wp-admin access to trusted IP ranges via server-level rules (e.g., nginx allow/deny directives) - this compensating control reduces exposure to social engineering delivery but does not remediate the underlying vulnerability. If token compromise is suspected, rotate Instagram and Facebook oEmbed access tokens through their respective developer consoles as an immediate containment step.