Flow-Flow Social Feed Stream <= 5.0.5 - Authenticated (Subscriber+) Missing Authorization to Backup Management, Debug Log Access, and Cron Execution
- ID
- WPSEC-2026-2938
- Plugin
- Flow-Flow Social Feed & Social Wall (flow-flow-social-streams)
- Affected
- from 5.0.1 before 5.0.8
- Remediation
- Update to 5.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Flow-Flow Social Feed Stream on WPSec AttackSurface
- Fix released
- Published
Description
The Flow-Flow Social Feed & Social Wall plugin for WordPress is vulnerable to unauthorized access via the create_backup, restore_backup, delete_backup, flow_flow_cron_run and flow_flow_debug_log AJAX actions in all versions up to, and including, 5.0.5, due to these handlers accepting the 'flow_flow_nonce' nonce in place of a capability check (the backup handler combined the capability and nonce checks with a logical AND), while the plugin printed that nonce on the front end to every user allowed to moderate streams. This makes it possible for authenticated attackers whose role has been granted stream moderation rights, which can be as low as subscriber, to create, restore and delete plugin backups, run the plugin's scheduled tasks, and read or clear the plugin debug log, which can contain social network tokens.
References
- https://wpsec.com/vuln/WPSEC-2026-2938/
- https://plugins.svn.wordpress.org/flow-flow-social-streams/tags/5.0.8/
- https://wordpress.org/plugins/flow-flow-social-streams/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS