---
id: CVE-2026-88931
title: >-
  The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which
  of its settings may be written through an unauthenticated endpoint, allowing
  attackers to overwrite arbitrary Social Web Suite  WordPress plugin through
  4.1.12…
summary: >-
  The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which
  of its settings may be written through an unauthenticated endpoint, allowing
  attackers to overwrite arbitrary Social Web Suite  WordPress plugin through
  4.1.12…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
published: '2026-10-09'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T15:17:19.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88931'
references:
  - url: 'https://wpscan.com/vulnerability/e1341110-abad-47f5-aed5-1c06cb0c8071/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00191
epssPercentile: 0.08712
ingestedAt: '2026-10-09T07:28:22.267Z'
product: Social Web Suite
affected:
  - social_web_suite <= 4.1.12
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-09T14:47:09.054503Z'
---

## Overview

The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite  WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.