Social Media Auto Post, Social Media Auto Publish (<= 4.1.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/social-media-auto-post-social-media-auto-publish--4.1.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 05:03:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSocial Web Suite: SQL injection and authentication bypass (CVE-2026-93904)https://feed.craftedsignal.io/briefs/2026-10-social-web-suite-sqli/Thu, 29 Oct 2026 05:03:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-social-web-suite-sqli/The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.The Social Web Suite plugin for WordPress, versions 4.1.12 and earlier, contains a critical SQL injection vulnerability in the 'exclude_posts' parameter. This is caused by insufficient input escaping and lack of parameterized queries. Furthermore, the plugin is vulnerable to an authentication bypass on newly installed instances where the administrator has not yet initialized the settings. In this state, the HMAC secret key is empty, allowing attackers to forge valid authentication tokens using a known hash calculation.

Impact

Unauthenticated attackers can extract sensitive data from the underlying WordPress database via the SQL injection vector. The authentication bypass enables attackers to reach protected endpoints without authorization.

Recommendation

  • Update the "Social Web Suite - Social Media Auto Post, Social Media Auto Publish" plugin to the latest patched version immediately.
  • Until a patch is applied, audit the plugin settings page for newly installed instances to ensure the HMAC secret key has been lazily generated.
  • Monitor web access logs for anomalous SQL syntax or repetitive POST requests targeting the plugin settings or API endpoints.
]]>highadvisorywordpresssqliauthentication-bypass