{"id":"CVE-2026-88931","state":"PUBLISHED","title":"Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update","description":"The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite  WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.","publishedAt":"2026-10-09T06:00:07.874Z","updatedAt":"2026-10-09T14:50:09.153Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Social Web Suite"],"affected":[{"vendor":"Unknown","product":"Social Web Suite","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.1.12","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/e1341110-abad-47f5-aed5-1c06cb0c8071/"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/88xxx/CVE-2026-88931.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-88931","state":"PUBLISHED","datePublished":"2026-10-09T06:00:07.874Z","dateUpdated":"2026-10-09T14:50:09.153Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-09-10T14:12:15.089Z"},"containers":{"cna":{"title":"Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update","descriptions":[{"lang":"en","value":"The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite  WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints."}],"affected":[{"vendor":"Unknown","product":"Social Web Suite","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.1.12","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e1341110-abad-47f5-aed5-1c06cb0c8071/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-10-09T06:00:07.874Z"},"credits":[{"lang":"en","value":"Naoki Kawahigashi","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-88931","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-09T14:47:09.054503Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","type":"CWE","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-09T14:50:09.153Z"}}]}}}