{
 "id": "WPSEC-2026-1995",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1995/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1995/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1995/index.md",
 "title": "Import Social Events <= 1.9.1 - Authenticated (Subscriber+) Missing Authorization to Facebook Access Token Update via OAuth Callback",
 "description": "The Import Social Events plugin for WordPress is vulnerable to unauthorized modification of data via the Facebook OAuth callback handler (admin-post action 'ife_facebook_authorize_callback') in all versions up to, and including, 1.9.1, due to a missing capability check and an OAuth 'state' check that only compared the request parameter against a cookie, both of which the requester controls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit a Facebook authorization code they obtained for the site's Facebook app. The plugin exchanges that code and overwrites the stored Facebook access token, connected user and page tokens, replacing the site's Facebook connection with one the attacker controls.",
 "plugin": {
  "slug": "import-facebook-events",
  "name": "Import Social Events",
  "full_name": "Import Social Events",
  "wordpress_org": "https://wordpress.org/plugins/import-facebook-events/",
  "advisories_url": "https://wpsec.com/vuln/plugin/import-facebook-events/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/import-facebook-events"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.2",
 "remediation": "Update to 1.9.2 or later.",
 "fix_released": "2026-10-29T06:08:28+00:00",
 "published": "2026-10-30T06:44:48+00:00",
 "updated": "2026-10-29T17:43:48.312522+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1995/",
  "https://plugins.svn.wordpress.org/import-facebook-events/tags/1.9.2/",
  "https://wordpress.org/plugins/import-facebook-events/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/import-facebook-events",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}