10Web Social Photo Feed
Monthly
Unauthenticated broken access control in the 10Web Social Photo Feed WordPress plugin (versions 1.4.35 and earlier) allows remote attackers to reach plugin functionality that should require authorization, giving limited read and write access to plugin-controlled data rather than full site compromise (CVSS 6.5, CWE-862, C:L/I:L/A:N). The CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are needed, and the attack is network-reachable at low complexity, so any site with the vulnerable plugin active is exposed without credentials. Exploitation is bounded by the Low confidentiality and integrity impact and by the need for the specific plugin/version; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated broken access control in the 10Web Social Photo Feed WordPress plugin (versions 1.4.35 and earlier) allows remote attackers to reach plugin functionality that should require authorization, giving limited read and write access to plugin-controlled data rather than full site compromise (CVSS 6.5, CWE-862, C:L/I:L/A:N). The CVSS vector confirms no authentication (PR:N) and no user interaction (UI:N) are needed, and the attack is network-reachable at low complexity, so any site with the vulnerable plugin active is exposed without credentials. Exploitation is bounded by the Low confidentiality and integrity impact and by the need for the specific plugin/version; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.