# Flow-Flow Social Feed Stream <= 5.0.5 - Unauthenticated Missing Authorization to Feed Cache Deletion and Forced Refresh

- **ID:** WPSEC-2026-2936
- **Plugin:** Flow-Flow Social Feed & Social Wall (`flow-flow-social-streams`), https://wordpress.org/plugins/flow-flow-social-streams/
- **Affected versions:** all versions before 5.0.8
- **Fixed in:** 5.0.8 (Update to 5.0.8 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/flow-flow-social-streams
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2936/

## Description

The Flow-Flow Social Feed & Social Wall plugin for WordPress is vulnerable to unauthorized cache manipulation in all versions up to, and including, 5.0.5 due to the public feed-fetching request honoring the 'clean', 'clean-stream' and 'force' parameters without any capability check. This makes it possible for unauthenticated attackers to wipe all cached feed posts and to bypass cache lifetimes, forcing repeated remote API refreshes that can exhaust API rate limits and degrade site availability.

## References

- https://wpsec.com/vuln/WPSEC-2026-2936/
- https://plugins.svn.wordpress.org/flow-flow-social-streams/tags/5.0.8/
- https://wordpress.org/plugins/flow-flow-social-streams/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2936/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.