CVE-2026-88930: high-severity vulnerability in Social Web Suite
Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.6epss 0.3%
exploitation probability
0.3%top 83% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Unknown · Social Web Suitepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/79204810-fd42-479d-bd2f-8762210f0fc5/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Social Web Suite
In the same product, most dangerous first.