{
 "id": "WPSEC-2026-2938",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2938/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2938/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2938/index.md",
 "title": "Flow-Flow Social Feed Stream <= 5.0.5 - Authenticated (Subscriber+) Missing Authorization to Backup Management, Debug Log Access, and Cron Execution",
 "description": "The Flow-Flow Social Feed & Social Wall plugin for WordPress is vulnerable to unauthorized access via the create_backup, restore_backup, delete_backup, flow_flow_cron_run and flow_flow_debug_log AJAX actions in all versions up to, and including, 5.0.5, due to these handlers accepting the 'flow_flow_nonce' nonce in place of a capability check (the backup handler combined the capability and nonce checks with a logical AND), while the plugin printed that nonce on the front end to every user allowed to moderate streams. This makes it possible for authenticated attackers whose role has been granted stream moderation rights, which can be as low as subscriber, to create, restore and delete plugin backups, run the plugin's scheduled tasks, and read or clear the plugin debug log, which can contain social network tokens.",
 "plugin": {
  "slug": "flow-flow-social-streams",
  "name": "Flow-Flow Social Feed Stream",
  "full_name": "Flow-Flow Social Feed & Social Wall",
  "wordpress_org": "https://wordpress.org/plugins/flow-flow-social-streams/",
  "advisories_url": "https://wpsec.com/vuln/plugin/flow-flow-social-streams/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/flow-flow-social-streams"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.0,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.0.1",
    "from_inclusive": true,
    "to": "5.0.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.0.1 before 5.0.8"
  ]
 },
 "introduced_in": "5.0.1",
 "fixed_in": "5.0.8",
 "remediation": "Update to 5.0.8 or later.",
 "fix_released": "2026-11-11T13:57:46+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:07.491734+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2938/",
  "https://plugins.svn.wordpress.org/flow-flow-social-streams/tags/5.0.8/",
  "https://wordpress.org/plugins/flow-flow-social-streams/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/flow-flow-social-streams",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}