Wp Social (<= 3.2.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wp-social--3.2.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 15:18:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWpmet Wp Social: Cross-Site Request Forgery (CVE-2026-122675)https://feed.craftedsignal.io/briefs/2026-11-wp-social-csrf/Sat, 07 Nov 2026 15:18:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wp-social-csrf/The Wp Social WordPress plugin is vulnerable to CSRF via the Admin_Settings::content_xs_providers() function, allowing an attacker to overwrite social login provider credentials if an authenticated administrator visits a malicious page.The Wp Social plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-122675). The vulnerability exists within the Admin_Settings::content_xs_providers() function in inc/admin-settings.php. The plugin fails to perform a nonce or referer check when processing the xs_provider_submit_form POST request. This flaw allows an unauthenticated attacker to manipulate social login provider settings, specifically the OAuth client ID and client secret, if an administrator with an active session is lured to a malicious page.

Impact

Successful exploitation allows an attacker to overwrite site-wide social login provider settings. This can lead to the redirection of OAuth authentication flows to attacker-controlled services, potentially facilitating unauthorized access or account takeover scenarios for users authenticating via social login providers.

Recommendation

  • Upgrade the Wp Social plugin to version 3.2.4 or later immediately.
  • Audit the xs_provider_data option in the WordPress database for unauthorized changes to OAuth client credentials.
  • Advise administrative users to avoid browsing untrusted websites while authenticated to the WordPress dashboard.
]]>lowadvisory