CVE-2026-93904

Name of the Vulnerable Software and Affected Versions The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress versions prior to 4.1.13

Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs due to insufficient escaping of user-supplied data and lack of proper preparation of the SQL query via the exclude posts parameter. Additionally, the HMAC (Hash-based Message Authentication Code) authentication gate protecting the endpoint can be bypassed on new installations if an administrator has not yet visited the settings page. In such cases, the secret key remains empty, allowing an attacker to generate a valid token using the hash hmac() function with an arbitrary timestamp.

Recommendations Update the plugin to a version newer than 4.1.12. As a temporary mitigation, avoid using the exclude posts parameter until the update is applied.