Social Web Suite EUVD-2026-96779

Exploitation is possible specifically when the plugin's shared secret has NOT been set - the plugin accepts requests 'authorised' by the shared secret without first requiring that secret to be configured, meaning fresh, unconfigured, or newly installed Social Web Suite installations (≤4.1.12) accept attacker requests and process the injectable parameter. No authentication, privileges, or user interaction are required per the CVSS vector (PR:N/UI:N), so any internet-facing WordPress site in this unconfigured state is directly exploitable. The primary limiting factor is deployment footprint: the target must run this specific plugin at a vulnerable version, and sites that have properly configured a shared secret may narrow (though per the description do not fully eliminate) the pre-authorisation acceptance behaviour - verify configured-site behaviour with the vendor/WPScan advisory.

This is a credible, actionable priority rather than a paper-tiger high-CVSS issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction - the easiest class of vulnerability to exploit - and CWE-89 (SQL injection) directly supports the stated confidentiality impact (C:H), enabling extraction of database contents such as WordPress user hashes and secrets. WPScan reports public exploit code exists, so the barrier to opportunistic exploitation is low. No EPSS score, SSVC decision, or KEV status was supplied in the input; the vulnerability is NOT listed as actively exploited in CISA KEV based on the data provided, so current real-world exploitation cannot be confirmed - the signal set is POC-available + high CVSS, which typically indicates elevated but not yet mass-exploited risk. The main tempering factor is prevalence: Social Web Suite is a comparatively niche WordPress plugin, so aggregate internet-wide risk is lower than a flaw in a ubiquitous plugin, even though any individual affected site is at high risk. Note a scope nuance: the input lists S:C, whereas a typical in-application SQLi affects the same security authority (S:N) - this inflates the input's 8.6 score and should be verified.

An unauthenticated attacker sends a crafted HTTP request to the Social Web Suite plugin's request-handling endpoint on a target WordPress site that has not configured its shared secret, injecting SQL into an unsanitised parameter. Because public exploit code exists (WPScan), the attacker can readily automate dumping sensitive database contents such as user credentials, nonces, and site secrets. No authentication, privileges, or user interaction are required, making opportunistic mass scanning of WordPress sites feasible.