low advisory November 7, 2026

Wpmet Wp Social: Cross-Site Request Forgery (CVE-2026-122675)

The Wp Social WordPress plugin is vulnerable to CSRF via the Admin_Settings::content_xs_providers() function, allowing an attacker to overwrite social login provider credentials if an authenticated administrator visits a malicious page.

Triage facts

Revision 1

Applicability: Wp Social (<= 3.2.3)
Evidence: Unknown
Severity: Low
Action: Elevated
Sources: 4 public sources
Freshness: Revision 1Nov 7, 15:18 UTC
Detection: 1 rule
Vulnerabilities: 1 CVE
Source quality: B2Likely

The Wp Social plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-122675). The vulnerability exists within the Admin_Settings::content_xs_providers() function in inc/admin-settings.php. The plugin fails to perform a nonce or referer check when processing the xs_provider_submit_form POST request. This flaw allows an unauthenticated attacker to manipulate social login provider settings, specifically the OAuth client ID and client secret, if an administrator with an active session is lured to a malicious page.

Impact

Successful exploitation allows an attacker to overwrite site-wide social login provider settings. This can lead to the redirection of OAuth authentication flows to attacker-controlled services, potentially facilitating unauthorized access or account takeover scenarios for users authenticating via social login providers.

Recommendation

Upgrade the Wp Social plugin to version 3.2.4 or later immediately.
Audit the xs_provider_data option in the WordPress database for unauthorized changes to OAuth client credentials.
Advise administrative users to avoid browsing untrusted websites while authenticated to the WordPress dashboard.

Immediate actions

Upgrade Wp Social plugin to version 3.2.4 or later

IT Operations 24h

Threat Hunt

Inspect database for abnormal social login provider configurations

T1098 high high confidence hunt now

Data: WordPress database options table

Mitigations

Upgrade to version 3.2.4

immediate IT Operations

CVE-2026-122675

Detection coverage 1

Detect Potential CVE-2026-122675 Exploitation

medium

Detects unauthorized POST requests to the Wp Social plugin settings endpoint which lacks CSRF protection

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →

CVE search metadata