CVE-2026-12002

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.2

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the maybe connection data() function. This allows unauthenticated attackers to overwrite Instagram and Facebook oEmbed access tokens using the sbi access token parameter by tricking a site administrator into clicking a malicious link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party.

Recommendations Update Smash Balloon Social Photo Feed – Easy Social Feeds Plugin to version 6.11.2 or later.