CVE-2026-88931
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: WPScan

Description
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-19
AI Q&A
2026-10-09
EPSS Evaluated
2026-10-18
NVD
CVE-2026-88931
EUVD
EUVD-2026-95504

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Social Web Suite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability CVE-2026-88931 affects the WordPress plugin Social Web Suite versions 4.1.12 and below. It allows unauthenticated attackers to update arbitrary plugin settings through an unrestricted endpoint. This includes overwriting critical settings like the shared secret that protects privileged plugin functions due to missing authorization checks.

Detection Guidance

Check if the Social Web Suite plugin version 4.1.12 or below is installed. Look for unauthorized modifications to plugin settings, especially the shared secret. Review server logs for suspicious requests to the plugin's endpoints.

Impact Analysis

Attackers could exploit this to modify plugin settings, potentially disabling security features, redirecting users, or gaining unauthorized access to privileged functions. This could lead to site defacement, data breaches, or further compromise of the WordPress installation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to plugin settings. If attackers overwrite critical settings, they might gain control over data handling or security configurations, which could lead to unauthorized access to sensitive data or improper data processing. This could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Disable the Social Web Suite plugin immediately if installed. Monitor for unauthorized changes to plugin settings. Apply any available updates once released. Restrict access to WordPress admin panels and endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart