PT-2024-15812 · WordPress · Enjoy Social Feed

Krzysztof Zając · Published 2024-03-18 · Updated 2025-05-05 · CVE-2024-0779

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enjoy Social Feed plugin for WordPress versions through 6.2.2

Description The issue concerns a lack of authorization and CSRF protection in various functions hooked to admin init, allowing unauthenticated users to call these functions. This enables attackers to unlink arbitrary users' Instagram accounts.

Recommendations For Enjoy Social Feed plugin for WordPress versions through 6.2.2, consider disabling the functions hooked to admin init as a temporary workaround until a patch is available. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-0779

Affected Products

Enjoy Social Feed

References · 6

• 🔥 https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2 · Exploit
• https://osv.dev/vulnerability/CVE-2024-0779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0779 · Security Note
• https://twitter.com/CVEnew/status/1769826045317022057 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1769827064377417868 · Twitter Post
• https://t.me/cvenotify/120854 · Telegram Post