Vulnerabilities / Flow-Flow Social Feed Stream / WPSEC-2026-2936
Flow-Flow Social Feed Stream <= 5.0.5 - Unauthenticated Missing Authorization to Feed Cache Deletion and Forced Refresh
Medium 6.5
CWE-862Fixed in 5.0.8
- ID
- WPSEC-2026-2936
- Plugin
- Flow-Flow Social Feed & Social Wall (flow-flow-social-streams)
- Affected
- all versions before 5.0.8
- Remediation
- Update to 5.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Flow-Flow Social Feed Stream on WPSec AttackSurface
- Fix released
- Published
Description
The Flow-Flow Social Feed & Social Wall plugin for WordPress is vulnerable to unauthorized cache manipulation in all versions up to, and including, 5.0.5 due to the public feed-fetching request honoring the 'clean', 'clean-stream' and 'force' parameters without any capability check. This makes it possible for unauthenticated attackers to wipe all cached feed posts and to bypass cache lifetimes, forcing repeated remote API refreshes that can exhaust API rate limits and degrade site availability.
References
- https://wpsec.com/vuln/WPSEC-2026-2936/
- https://plugins.svn.wordpress.org/flow-flow-social-streams/tags/5.0.8/
- https://wordpress.org/plugins/flow-flow-social-streams/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS