CVE-2026-93904

{
  "etk_id": "ETK-2026-2935",
  "cve_id": "CVE-2026-93904",
  "display_id": "CVE-2026-93904",
  "ghsa_id": "GHSA-r2j7-7525-ff3c",
  "euvd_id": "EUVD-2026-112588",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Social Web Suite WordPress plugin",
  "summary": "Social Web Suite – Social Media Auto Post, Social Media Auto Publish through 4.1.12 contains an SQL injection flaw. An unauthenticated remote attacker may access database information on newly activated installations where the administrator has not opened the plugin settings and its request-authentication secret remains uninitialized.",
  "mitigation": "Open the plugin settings as an administrator to initialize the authentication secret, and disable or restrict public access to the affected plugin endpoint. No fixed release is recorded; remove or disable the plugin if its exposure cannot be controlled pending a vendor update.",
  "vendor": "dejanmarkovic",
  "product": "Social Web Suite – Social Media Auto Post, Social Media Auto Publish",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.1.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Social Web Suite – Social Media Auto Post, Social Media Auto Publish",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.011625416666666666,
  "t0_at": "2026-10-29T03:39:14.706000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-29T04:02:45.634202+00:00",
      "days": 0.01633018752314815,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:14.706000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-29T03:39:14.706000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:14.706000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93904"
    }
  }
}