CVE-2026-88931

MediumCVSS 5.3/10Last modified Oct 9, 2026

Description

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Social Web Suite	<= 4.1.12

References

https://wpscan.com/vulnerability/e1341110-abad-47f5-aed5-1c06cb0c8071/

Timeline

Published: Oct 9, 2026
Last modified: Oct 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-889325.3multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage CVE-2026-889378.8knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to re CVE-2026-889386.5knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read s CVE-2026-889398.3knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypa CVE-2026-88946.4The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to,CVE-2026-889405.3knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate ar CVE-2026-889415.2Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentiall CVE-2026-889426.1The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter CVE-2026-889444.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i CVE-2026-88956.4The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up CVE-2026-889529.1Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAu CVE-2026-889566.8The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interf