CVE-2026-122675 · Runtime
NO FIX YET
The WP Social WordPress plugin by Wpmet has a cross-site request forgery flaw affecting versions through 3.2.3. A logged-in administrator who opens a malicious page could be tricked into making settings changes they did not intend.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WP Social plugin at version 3.2.3 or older are in the affected range, according to the NVD entry. The risk depends on logged-in administrators visiting attacker-controlled pages while signed in. Sites that do not use the plugin can skip it.
Not affected if plugin-not-installed
Who cares self-hosted, wordpress, wp-social
wp plugin get wp-social --field=version3.2.3 or olderNo fix yet, per the sources.
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.