Import Social Events <= 1.9.1 - Authenticated (Subscriber+) Missing Authorization to Facebook Access Token Update via OAuth Callback
- ID
- WPSEC-2026-1995
- Plugin
- Import Social Events (import-facebook-events)
- Affected
- all versions before 1.9.2
- Remediation
- Update to 1.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Import Social Events on WPSec AttackSurface
- Fix released
- Published
Description
The Import Social Events plugin for WordPress is vulnerable to unauthorized modification of data via the Facebook OAuth callback handler (admin-post action 'ife_facebook_authorize_callback') in all versions up to, and including, 1.9.1, due to a missing capability check and an OAuth 'state' check that only compared the request parameter against a cookie, both of which the requester controls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit a Facebook authorization code they obtained for the site's Facebook app. The plugin exchanges that code and overwrites the stored Facebook access token, connected user and page tokens, replacing the site's Facebook connection with one the attacker controls.
References
- https://wpsec.com/vuln/WPSEC-2026-1995/
- https://plugins.svn.wordpress.org/import-facebook-events/tags/1.9.2/
- https://wordpress.org/plugins/import-facebook-events/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS