EUVD-2026-90838
GHSA-5jpc-88rh-pm39
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain subscriber account
-
ExploitAuthenticate to WordPress
-
ExecutionCall plugin action lacking authz check
-
ImpactPerform unauthorized operation or read restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account at subscriber level (PR:L) on a site running Social Boost plugin version 3.6.2 or earlier; exploitation is network-based with no user interaction. The practical limiting factor is the need for a valid low-privilege account - most impactful on sites that permit open/self-service user registration, where any visitor can obtain a subscriber role. The specific plugin feature, endpoint, or action missing the authorization check is not named in the available data, so defenders should consult the Patchstack advisory to identify the exact exposed capability. |
| Impact | Risk signals are limited and partly conflicting. The vendor (Patchstack) CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L yields 7.6 (High), driven almost entirely by C:H. However, the description - 'Subscriber Broken Access Control in Social Boost <= 3.6.2' (CWE-862) - provides no detail on what sensitive data or action is exposed, making the C:H (full confidentiality loss) rating appear inflated for a subscriber-level missing-authorization flaw; a more conservative independent read lands closer to 5-6. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automatable exploitation. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but it requires authentication (PR:L) - a valid subscriber account - which meaningfully gates real-world exploitation on sites that do not allow open/self-service registration. Net: this is a moderate-priority, authenticated, niche-plugin issue rather than a high-urgency internet-wide threat; the headline 7.6 overstates practical risk given the authentication requirement, sparse impact detail, and absence of exploitation signals. Verify the actual exposed capability/data with the Patchstack advisory before treating C:H as confirmed. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege subscriber account on a WordPress site running Social Boost <= 3.6.2, then invokes a plugin endpoint or action that lacks a proper capability/authorization check. Because the control is missing, the subscriber performs operations or reads data intended for higher-privileged roles. No public exploit code is identified at time of analysis, and exploitation requires an authenticated subscriber session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Broken access control in the Social Boost WordPress plugin through version 3.6.2 allows an authenticated subscriber-level user to reach plugin functionality that should be reserved for higher-privileged roles, resulting in unauthorized data exposure and limited modification of site content or configuration. The flaw is a classic missing-authorization issue (CWE-862) reachable over the network with no user interaction, so sites that allow open or self-service registration are the most exposed: any visitor who can obtain a subscriber account meets the only real prerequisite. Independent assessment rates the impact as comparatively contained (confidentiality and integrity low, availability none) and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor advisory from Patchstack is available.
RemediationAI
No vendor-released patch identifying an exact fixed version was available at time of analysis, so the first step is to check the Patchstack advisory and the plugin's WordPress.org page for a version newer than 3.6.2 and update as soon as one is published; if the plugin is not essential to the site, deactivating and removing it eliminates the exposure entirely (trade-off: loss of the social-sharing/boost functionality). Where the plugin must remain, restrict who can reach the vulnerable path by hardening account provisioning - disable open or self-service subscriber registration, and audit and remove unnecessary subscriber accounts - since exploitation depends on holding a valid low-privilege login (trade-off: reduced user onboarding and potential support overhead on membership sites). Additional compensating controls include front-end WAF or reverse-proxy rules that block anomalous direct requests to the plugin's AJAX/REST handlers from low-privilege sessions, and temporarily reviewing/limiting plugin shortcodes and REST routes exposed to subscriber roles; these reduce but do not eliminate risk and may break legitimate plugin behavior if the filter is too broad. Monitor the advisory at https://patchstack.com/database/wordpress/plugin/social-boost/vulnerability/wordpress-social-boost-plugin-3-6-2-broken-access-control-vulnerability?_s_id=cve for the fixed release, and audit logs for subscriber accounts invoking plugin endpoints they do not normally use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Social Boost is a third-party WordPress plugin distributed through the WordPress.org ecosystem and mapped in the CPE dictionary as cpe:2.3:a:apps_mav:social_boost, with all versions up to and including 3.6.2 in scope per the single wildcard version range in the affected CPE. The root cause class is CWE-862 (Missing Authorization): one or more plugin actions, endpoints, or REST/AJAX handlers are registered without an adequate capability check (for example, missing current_user_can() or check_ajax_referer()-style guards), so a request from an account holding only the subscriber role is processed as if it came from an authorized user. The CVSS vector supplied by the reporter (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) agree on the exploitability profile - remote, low complexity, no user interaction, and requiring a low-privilege authenticated account (PR:L, i.e., subscriber level) - but diverge on impact severity, with the assessment lowering confidentiality to Low and availability to None because the specific over-exposed plugin capability is not identified in the available data. No EPSS score, KEV entry, or patch commit/PR is present in the supplied intelligence, and the only reference is the Patchstack vulnerability advisory, which is the authoritative source for identifying the exact endpoint, action, or parameter that fails to enforce authorization.
Know when Social Boost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Authenticated subscriber (PR:L) over network (AV:N/AC:L); sparse description does not support full C:H, so confidentiality/integrity assessed low and availability N absent evidence.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.
Executive ViewAI
The Social Boost plugin for WordPress, in all versions up to and including 3.6.2, contains an access-control gap that lets an ordinary subscriber-level account reach administrative plugin functions. Because the only prerequisite is a low-privilege account, any WordPress site that permits open or self-service registration effectively exposes those functions to the public - the exposure is broad but the per-incident consequence is bounded (limited data disclosure and limited ability to alter site content or configuration). Leadership should care because the affected population is potentially every registered user on open-registration sites, no vendor fix is yet available, and remediation depends on interim controls until a patched release ships.
No vendor-released patch identified at time of analysis; interim mitigations are to close the reachability prerequisite and contain blast radius - disable or restrict self-service registration (or require administrator approval for new accounts), deactivate the Social Boost plugin on non-essential sites, apply least-privilege role and capability reviews to existing subscriber accounts, deploy WAF/virtual-patching rules to block unauthorized requests to plugin functionality, and monitor site content, configuration, and account logs for anomalies until a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB