{"id":"CVE-2026-125799","kind":"vulnerability","aliases":["CVE-2026-125799"],"related":[],"title":"Flow-Flow Social Stream: sensitive data embedded in public files exposed","description":"Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Social Stream flow-flow-social-streams allows Retrieve Embedded Sensitive Data.This issue affects Flow-Flow Social Stream: from n/a through 5.0.5.","summary":"Flow-Flow Social Stream, a WordPress plugin that shows social media feeds, writes sensitive information into files or directories that outsiders can reach. An attacker can retrieve that embedded sensitive data from the web.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flow-flow-social-streams","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Flow-Flow Social Stream plugin version in the WordPress admin plugin list; affected versions are listed as through `5.0.5`.","fix":"- Flow-Flow Social Stream: move to a version later than `5.0.5`","status":"open","published_at":"2026-11-15T15:16:47+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","triaged_at":"2026-11-15T15:37:09+00:00","updated_at":"2026-11-15T15:37:09+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-15T15:37:09Z","model":"claude-haiku-5-5","output":{"fix":"- Flow-Flow Social Stream: move to a version later than `5.0.5`\n- unknown","reach":"internet","title":"Flow-Flow Social Stream: sensitive data embedded in public files exposed","impact":"medium","summary":"Flow-Flow Social Stream, a WordPress plugin that shows social media feeds, writes sensitive information into files or directories that outsiders can reach. An attacker can retrieve that embedded sensitive data from the web.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","flow-flow-social-streams","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive data readable by anyone who fetches the file","analyst_note":"Confirm the affected data and any fixed version from the NVD entry or the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-125799.","how_to_check":"- Check the installed Flow-Flow Social Stream plugin version in the WordPress admin plugin list; affected versions are listed as through `5.0.5`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Flow-Flow Social Stream up to and including 5.0.5 are exposed, since the data sits in externally reachable files. Sites without the plugin can skip it. The sources do not say which configuration or data is involved.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4565,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125799':15A,18A '-2026':14A,17A '5.0.5':104C 'access':71C 'affect':95C 'allow':89C 'attack':54B 'awesom':78C 'cve':13A,16A 'data':7A,60B 'data.this':93C 'directori':48B,74C 'embed':8A,58B,91C 'expos':12A 'extern':70C 'externally-access':69C 'feed':41B 'file':11A,46B,72C 'flow':2A,3A,20B,21B,30B,31B,80C,81C,85C,86C,97C,98C 'flow-flow':1A,29B,79C,96C 'flow-flow-social-stream':19B,84C 'host':27B 'inform':44B,67C 'insert':64C 'issu':94C 'look':77C 'media':40B 'n/a':102C 'outsid':50B 'packag':24B 'plugin':36B 'public':10A 'reach':52B 'retriev':56B,90C 'self':26B 'self-host':25B 'sensit':6A,43B,59B,66C,92C 'show':38B 'social':4A,22B,32B,39B,82C,87C,99C 'stream':5A,23B,33B,83C,88C,100C 'vulner':75C 'web':63B 'wordpress':28B,35B 'write':42B","nicknames":[],"mitigations":[],"who_affected":"Sites running Flow-Flow Social Stream up to and including 5.0.5 are exposed, since the data sits in externally reachable files. Sites without the plugin can skip it. The sources do not say which configuration or data is involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flowflowsocialstreams","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125799':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':7A 'embed':8A 'expos':12A 'file':11A 'flow':2A,3A 'flow-flow':1A 'public':10A 'sensit':6A 'social':4A 'stream':5A","search_b":"'attack':54B 'data':60B 'directori':48B 'embed':58B 'feed':41B 'file':46B 'flow':20B,21B,30B,31B 'flow-flow':29B 'flow-flow-social-stream':19B 'host':27B 'inform':44B 'media':40B 'outsid':50B 'packag':24B 'plugin':36B 'reach':52B 'retriev':56B 'self':26B 'self-host':25B 'sensit':43B,59B 'show':38B 'social':22B,32B,39B 'stream':23B,33B 'web':63B 'wordpress':28B,35B 'write':42B","search_c":"'5.0.5':104C 'access':71C 'affect':95C 'allow':89C 'awesom':78C 'data.this':93C 'directori':74C 'embed':91C 'extern':70C 'externally-access':69C 'file':72C 'flow':80C,81C,85C,86C,97C,98C 'flow-flow':79C,96C 'flow-flow-social-stream':84C 'inform':67C 'insert':64C 'issu':94C 'look':77C 'n/a':102C 'retriev':90C 'sensit':66C,92C 'social':82C,87C,99C 'stream':83C,88C,100C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T15:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125799","severity":null,"published_at":"2026-11-15T15:16:47+00:00","modified_at":"2026-11-15T15:16:47+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","fetched_at":"2026-11-15T15:36:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}