Social Snap WordPress plugin: PHP Object Injection via Contributor account

Summary

The Social Snap WordPress plugin up to and including version 1.5.4 contains a PHP Object Injection vulnerability (CWE-502) that is rated 8.8 (High) by the CNA Patchstack. An authenticated attacker with a Contributor-level account can submit crafted serialized data, which may allow manipulation of server-side processing and, depending on the available gadget chains, further compromise of the website. The exact vulnerable input is not specified in the sources reviewed.

Affected

• Social Snap WordPress plugin, all versions up to and including 1.5.4
• Exploitation requires a logged-in account with the Contributor role

Fixed in

Unknown. No fixed version has been confirmed; the Patchstack advisory states no official patch was available at the time of publication.

Workaround

• Disable or remove the plugin if it is not essential
• Review accounts with the Contributor role and remove unnecessary ones
• Restrict or disable open user registration
• Enforce strong passwords and two-factor authentication for editor and author accounts
• Consider a web application firewall or virtual patching if available; no confirmed rule for this issue was identified

Exploitation

• Not known to be exploited in the wild (as of the sources reviewed)
• No public proof of concept is known according to VulDB
• Not listed in CISA KEV
• EPSS: 0.37 % (percentile 31)
• CISA SSVC: exploitation none, automatable no, technical impact total

Our recommendation

• Inventory WordPress sites that have the Social Snap plugin installed and check the installed version
• Disable the plugin on sites where it is not required
• Remove unnecessary Contributor and other low-privilege accounts and close open registration
• Update the plugin as soon as a fixed version is confirmed by Patchstack or WordPress.org
• Monitor the Patchstack advisory, KEV and public PoC sources for changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry 428512 vuldb.com
• OffSeq Radar CVE-2026-118080 radar.offseq.com
• Strix CVE-2026-118080 www.strix.ai
• Plugin Tests Social Snap plugintests.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:07.