Social Web Suite CVE-2026-88931

Exploitation requires that a vulnerable installation of the Social Web Suite WordPress plugin (version ≤ 4.1.12) be installed and active on an internet-reachable WordPress site; no authentication, privileges, or user interaction are needed (CVSS PR:N/UI:N), and default configurations are affected because the write endpoint itself lacks an authorization check. The primary limiting factor is deployment scope rather than configuration: the target must simply be running this specific plugin at a vulnerable version. Impact is bounded to overwriting plugin options (integrity), with the highest-value target being the shared secret guarding privileged endpoints, so realized severity depends on what those privileged endpoints permit once the secret is attacker-controlled.

This is a genuine but moderate-priority issue, best understood as a stepping-stone rather than a direct catastrophic flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) and the signals are internally consistent: network-reachable, low-complexity, no privileges and no user interaction, with only a Low integrity impact and no confidentiality or availability loss. The core danger is architectural - the missing authorization (CWE-862) lets an unauthenticated attacker overwrite arbitrary plugin options, and critically the shared secret that guards the plugin's own privileged endpoints, so the scored I:L understates the real threat because this flaw is a bypass enabler for subsequent privileged actions. EPSS is low at 0.14% (3rd percentile), and the CVE is NOT in CISA KEV, so there is no evidence of active mass exploitation; however, public exploit code exists (WPScan), which raises practical opportunistic risk against unpatched WordPress sites even if automated weaponization is not yet observed. Note the tension worth flagging: the CPE vendor is literally 'unknown' and affected-version data comes only from WPScan/EUVD, so vendor confirmation of fix status is weak. Bottom line: a real, easily-reachable authorization gap whose raw 5.3 belies its value as a precursor to privileged-endpoint abuse, but with low observed exploitation prevalence.

An attacker sends an unauthenticated HTTP request to the plugin's unprotected settings endpoint and overwrites the shared secret that the plugin uses to authorize its privileged endpoints. Having set a secret of their choosing, the attacker can then present that secret to invoke the plugin's protected functionality, effectively bypassing its access control. Public exploit code for this authorization bypass is available via WPScan, lowering the skill required.