Social Boost
Monthly
Broken access control in the Social Boost WordPress plugin through version 3.6.2 allows an authenticated subscriber-level user to reach plugin functionality that should be reserved for higher-privileged roles, resulting in unauthorized data exposure and limited modification of site content or configuration. The flaw is a classic missing-authorization issue (CWE-862) reachable over the network with no user interaction, so sites that allow open or self-service registration are the most exposed: any visitor who can obtain a subscriber account meets the only real prerequisite. Independent assessment rates the impact as comparatively contained (confidentiality and integrity low, availability none) and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor advisory from Patchstack is available.
Broken access control in the Social Boost WordPress plugin through version 3.6.2 allows an authenticated subscriber-level user to reach plugin functionality that should be reserved for higher-privileged roles, resulting in unauthorized data exposure and limited modification of site content or configuration. The flaw is a classic missing-authorization issue (CWE-862) reachable over the network with no user interaction, so sites that allow open or self-service registration are the most exposed: any visitor who can obtain a subscriber account meets the only real prerequisite. Independent assessment rates the impact as comparatively contained (confidentiality and integrity low, availability none) and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor advisory from Patchstack is available.