Description
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
Published: 2026-10-06
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to protected resources
Action: Immediate Update
AI Analysis

Impact

The vulnerability is an unauthenticated broken access control flaw in the 10Web Social Photo Feed plugin. This flaw allows an attacker to access or manipulate features that should be protected, potentially exposing private images or altering feed settings without being logged in. The weakness is identified as CWE‑862.

Affected Systems

The affected product is the 10Web Social Photo Feed WordPress plugin, version 1.4.35 or earlier. WordPress sites that have installed these plugin versions are vulnerable. The plugin may be present as part of a WordPress installation; no specific configuration requirements are listed.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. Because the EPSS score is 0.29%, the likelihood of exploitation is very low, and the vulnerability is not currently listed in CISA's KEV catalog. The vulnerability could be exploited remotely via the plugin’s public-facing endpoints, although specific details are not provided.

Generated by OpenCVE AI on October 7, 2026 at 05:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the 10Web Social Photo Feed plugin to the latest version (>= 1.4.36) to eliminate the broken access control flaw.
  • If an immediate update cannot be applied, temporarily restrict the plugin’s usage to administrators only or disable it until the vulnerability is patched.
  • Conduct a security scan of the WordPress installation to confirm no unintended access to protected resources remains and verify the integrity of access controls for affected endpoints.

Generated by OpenCVE AI on October 7, 2026 at 05:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared 10web
10web 10web Social Post Feed
Wordpress-extensions
Wordpress-extensions 10web Social Photo Feed
Vendors & Products 10web
10web 10web Social Post Feed
Wordpress-extensions
Wordpress-extensions 10web Social Photo Feed

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
Title WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

10web 10web Social Post Feed
Wordpress-extensions 10web Social Photo Feed
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:34.287Z

Reserved: 2026-04-07T10:59:15.736Z

Link: CVE-2026-39787

cve-icon Vulnrichment

Updated: 2026-10-06T10:29:29.168Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:51.267

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-39787

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:45:13Z

Weaknesses