{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wpmet/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpmet:wp_social:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":5.4,"id":"CVE-2026-122675"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wp Social (\u003c= 3.2.3)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Wpmet"],"content_html":"\u003cp\u003eThe Wp Social plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-122675). The vulnerability exists within the \u003ccode\u003eAdmin_Settings::content_xs_providers()\u003c/code\u003e function in \u003ccode\u003einc/admin-settings.php\u003c/code\u003e. The plugin fails to perform a nonce or referer check when processing the \u003ccode\u003exs_provider_submit_form\u003c/code\u003e POST request. This flaw allows an unauthenticated attacker to manipulate social login provider settings, specifically the OAuth client ID and client secret, if an administrator with an active session is lured to a malicious page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to overwrite site-wide social login provider settings. This can lead to the redirection of OAuth authentication flows to attacker-controlled services, potentially facilitating unauthorized access or account takeover scenarios for users authenticating via social login providers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Wp Social plugin to version 3.2.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003exs_provider_data\u003c/code\u003e option in the WordPress database for unauthorized changes to OAuth client credentials.\u003c/li\u003e\n\u003cli\u003eAdvise administrative users to avoid browsing untrusted websites while authenticated to the WordPress dashboard.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T15:18:09Z","date_published":"2026-11-07T15:18:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wp-social-csrf/","summary":"The Wp Social WordPress plugin is vulnerable to CSRF via the Admin_Settings::content_xs_providers() function, allowing an attacker to overwrite social login provider credentials if an authenticated administrator visits a malicious page.","title":"Wpmet Wp Social: Cross-Site Request Forgery (CVE-2026-122675)","url":"https://feed.craftedsignal.io/briefs/2026-11-wp-social-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Wpmet","version":"https://jsonfeed.org/version/1.1"}