{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/social-media-auto-post-social-media-auto-publish--4.1.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:social_web_suite:social_media_auto_post_social_media_auto_publish:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-93904"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Social Media Auto Post, Social Media Auto Publish (\u003c= 4.1.12)"],"_cs_severities":["high"],"_cs_tags":["wordpress","sqli","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Social Web Suite"],"content_html":"\u003cp\u003eThe Social Web Suite plugin for WordPress, versions 4.1.12 and earlier, contains a critical SQL injection vulnerability in the 'exclude_posts' parameter. This is caused by insufficient input escaping and lack of parameterized queries. Furthermore, the plugin is vulnerable to an authentication bypass on newly installed instances where the administrator has not yet initialized the settings. In this state, the HMAC secret key is empty, allowing attackers to forge valid authentication tokens using a known hash calculation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthenticated attackers can extract sensitive data from the underlying WordPress database via the SQL injection vector. The authentication bypass enables attackers to reach protected endpoints without authorization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Social Web Suite - Social Media Auto Post, Social Media Auto Publish\u0026quot; plugin to the latest patched version immediately.\u003c/li\u003e\n\u003cli\u003eUntil a patch is applied, audit the plugin settings page for newly installed instances to ensure the HMAC secret key has been lazily generated.\u003c/li\u003e\n\u003cli\u003eMonitor web access logs for anomalous SQL syntax or repetitive POST requests targeting the plugin settings or API endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T05:03:29Z","date_published":"2026-10-29T05:03:29Z","id":"https://feed.craftedsignal.io/briefs/2026-10-social-web-suite-sqli/","summary":"The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.","title":"Social Web Suite: SQL injection and authentication bypass (CVE-2026-93904)","url":"https://feed.craftedsignal.io/briefs/2026-10-social-web-suite-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Social Media Auto Post, Social Media Auto Publish (\u003c= 4.1.12)","version":"https://jsonfeed.org/version/1.1"}