Social Web Suite: SQL injection and authentication bypass (CVE-2026-93904)

The Social Web Suite plugin for WordPress, versions 4.1.12 and earlier, contains a critical SQL injection vulnerability in the 'exclude_posts' parameter. This is caused by insufficient input escaping and lack of parameterized queries. Furthermore, the plugin is vulnerable to an authentication bypass on newly installed instances where the administrator has not yet initialized the settings. In this state, the HMAC secret key is empty, allowing attackers to forge valid authentication tokens using a known hash calculation.

Impact

Unauthenticated attackers can extract sensitive data from the underlying WordPress database via the SQL injection vector. The authentication bypass enables attackers to reach protected endpoints without authorization.

Recommendation

• Update the "Social Web Suite - Social Media Auto Post, Social Media Auto Publish" plugin to the latest patched version immediately.
• Until a patch is applied, audit the plugin settings page for newly installed instances to ensure the HMAC secret key has been lazily generated.
• Monitor web access logs for anomalous SQL syntax or repetitive POST requests targeting the plugin settings or API endpoints.