CVE-2026-97227 | BDVDB-2026-380010 Detail

Description#

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-27Record published in the CVE List.
2. Version 22026-09-28Most recent update recorded in the CVE List.