The Social Web Suite WordPress plugin version 4.1.12 and earlier exposes an endpoint that accepts requests without authentication. This endpoint can write to any plugin setting, including a shared secret that protects privileged functionality. An attacker who submits a crafted request can overwrite the secret and thereby gain control over the plugin’s privileged commands, effectively elevating privileges within the site.

All installations of the Social Web Suite WordPress plugin with a version of 4.1.12 or earlier. The product is managed by the unknown social web suite vendor, and the vulnerability only applies to the plugin itself, not to WordPress core or other plugins.

Because the vulnerable endpoint is publicly accessible, exploitation does not require credentials or user interaction beyond sending a crafted request. The EPSS score of < 1% indicates a very low probability that an attacker will exploit this vulnerability, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker could overwrite the shared secret to gain control over the plugin’s privileged commands, potentially enabling further compromise if those commands include malicious code execution or data exfiltration. The CVSS score of 5.3 reflects moderate severity.