# Import Social Events <= 1.9.1 - Authenticated (Subscriber+) Missing Authorization to Facebook Access Token Update via OAuth Callback

- **ID:** WPSEC-2026-1995
- **Plugin:** Import Social Events (`import-facebook-events`), https://wordpress.org/plugins/import-facebook-events/
- **Affected versions:** all versions before 1.9.2
- **Fixed in:** 1.9.2 (Update to 1.9.2 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/import-facebook-events
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1995/

## Description

The Import Social Events plugin for WordPress is vulnerable to unauthorized modification of data via the Facebook OAuth callback handler (admin-post action 'ife_facebook_authorize_callback') in all versions up to, and including, 1.9.1, due to a missing capability check and an OAuth 'state' check that only compared the request parameter against a cookie, both of which the requester controls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit a Facebook authorization code they obtained for the site's Facebook app. The plugin exchanges that code and overwrites the stored Facebook access token, connected user and page tokens, replacing the site's Facebook connection with one the attacker controls.

## References

- https://wpsec.com/vuln/WPSEC-2026-1995/
- https://plugins.svn.wordpress.org/import-facebook-events/tags/1.9.2/
- https://wordpress.org/plugins/import-facebook-events/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1995/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.