CVE-2024-0779 - Vulnerability Details - OpenCVE

Description

The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example

Published: 2024-03-18

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Unknown

Enjoy Social Feed plugin for WordPress website

affected

Version	Status	Constraints
`0`	affected	≤ 6.2.2

Configuration 1 [-]

cpe:2.3:a:mediabetaprojects:enjoy_social_feed:*:*:*:*:*:wordpress:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00308.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/

History

Mon, 05 May 2025 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediabetaprojects Mediabetaprojects enjoy Social Feed
Weaknesses		CWE-352
CPEs		cpe:2.3:a:mediabetaprojects:enjoy_social_feed::::::wordpress::*
Vendors & Products		Mediabetaprojects Mediabetaprojects enjoy Social Feed

Subscriptions

Mediabetaprojects Enjoy Social Feed

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-03-18T19:05:42.163Z

Updated: 2024-08-28T15:36:30.412Z

Reserved: 2024-01-22T10:25:55.631Z

Link: CVE-2024-0779

Vulnrichment

Updated: 2024-08-01T18:18:18.348Z

NVD

Status : Analyzed

Published: 2024-03-18T19:15:06.390

Modified: 2025-05-05T18:56:44.187

Link: CVE-2024-0779

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-352

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0779", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-01-22T10:25:55.631Z", "datePublished": "2024-03-18T19:05:42.163Z", "dateUpdated": "2024-08-28T15:36:30.412Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-03-18T19:05:42.163Z"}, "title": "Enjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Enjoy Social Feed plugin for WordPress website", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "6.2.2"}], "defaultStatus": "affected", "collectionURL": "https://wordpress.org/plugins"}], "descriptions": [{"lang": "en", "value": "The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example"}], "references": [{"url": "https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Krzysztof Zaj\u0105c (CERT PL)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"affected": [{"vendor": "mediabeta", "product": "enjoy_social_feed", "cpes": ["cpe:2.3:a:mediabeta:enjoy_social_feed:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.2.2", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-19T14:41:19.221791Z", "id": "CVE-2024-0779", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-28T15:36:30.412Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.348Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.348Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-0779", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-19T14:41:19.221791Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:enjoy_social_feed_plugin_for_wordpress_website:enjoy_social_feed_plugin_for_wordpress_website:*:*:*:*:*:*:*:*"], "vendor": "enjoy_social_feed_plugin_for_wordpress_website", "product": "enjoy_social_feed_plugin_for_wordpress_website", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.2.2"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T15:22:06.548Z"}}], "cna": {"title": "Enjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Krzysztof Zaj\u0105c (CERT PL)"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Enjoy Social Feed plugin for WordPress website", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.2.2"}], "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "affected"}], "references": [{"url": "https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-862 Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-03-18T19:05:42.163Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0779", "state": "PUBLISHED", "dateUpdated": "2024-08-28T15:36:30.412Z", "dateReserved": "2024-01-22T10:25:55.631Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-03-18T19:05:42.163Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}