Social Web Suite: Unauthenticated SQL injection via unset shared secret
Summary
The Social Web Suite WordPress plugin up to and including 4.1.12 accepts requests authorised by its shared secret even when that secret has not been set. A parameter is also used in an SQL statement without sanitisation or escaping. An unauthenticated remote attacker can exploit this to run SQL injection attacks and may read database contents, such as customer or account data. No fix is known at the time of writing.
Affected
- Social Web Suite WordPress plugin, versions up to and including 4.1.12
Fixed in
Unknown. WPScan lists no known fix.
Workaround
- Deactivate and remove the plugin if it is not business-critical.
- If it must stay, restrict access to its endpoints at web server or firewall level.
- Check whether the shared secret can be set to a strong random value in the plugin settings. Test this on a non-production system first.
Exploitation
- Public proof of concept: unconfirmed.
- In the wild: nothing found. Not listed in CISA KEV.
- EPSS: about 0.18% (low).
- CISA SSVC: automatable, exploitation status 'none' at the time of the record.
Our recommendation
- Check whether the plugin is installed on any WordPress site.
- If it is installed and no fix exists, deactivate and remove it.
- If removal is not possible, restrict its endpoints, take a full backup first and review logs for unusual requests to the plugin paths.
- Watch for a vendor fix or a Patchstack or WPScan update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-88930 app.opencve.io
- Patchstack via Vulners vulners.com
- Radar Offseq CVE-2026-88930 radar.offseq.com
- CVE Threatint CVE-2026-88930 cve.threatint.com
- VulDB entry 428285 (related CVE-2026-93904) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:58.
Original description (NVD)
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.