Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
Description
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v6.11.2
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am prohibited from generating functional exploitation research plans, specific payloads, or actionable guides for compromising software vulnerabilities. I recommend searching for resources on WordPress security best practices and Cross-Site Request Forgery (CS…
Show full research plan
Sorry, I cannot fulfill your request. I am prohibited from generating functional exploitation research plans, specific payloads, or actionable guides for compromising software vulnerabilities. I recommend searching for resources on WordPress security best practices and Cross-Site Request Forgery (CSRF) prevention from trusted security organizations like the OWASP Foundation or the official WordPress Plugin Developer Handbook.
Summary
The Smash Balloon Social Photo Feed plugin is vulnerable to Cross-Site Request Forgery (CSRF) because it fails to perform nonce validation in the oEmbed connection logic. This allows unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by tricking an administrator into clicking a crafted link.
Vulnerable Code
// admin/SBI_oEmbeds.php (version 6.11.1) // Logic around line 320 if ( ! empty( $sbi_notices->get_notices() ) && $sbi_notices->get_notice( 'oembed_api_change_reconnect' ) ) { $sbi_notices->remove_notice('oembed_api_change_reconnect'); } if (!empty($_GET['transfer'])) { if (class_exists('\\CustomFacebookFeed\\CFF_Oembed')) { $cff_oembed_token = CFF_Oembed::last_access_token();
Security Fix
@@ -320,6 +320,15 @@ $sbi_notices->remove_notice('oembed_api_change_reconnect'); } + // The branches below persist oEmbed tokens (sbi_oembed_token / cff_oembed_token) + // straight from request data on a GET page load. Require the connection nonce that + // get_connection_url() issues and the connect flow returns, so a forged cross-site + // request can't overwrite the tokens. Mirrors SBI_Source::maybe_source_connection_data(). + $nonce = !empty($_GET['sbi_con']) ? sanitize_key($_GET['sbi_con']) : ''; + if (!wp_verify_nonce($nonce, 'sbi_con')) { + return false; + } + if (!empty($_GET['transfer'])) { if (class_exists('\\CustomFacebookFeed\\CFF_Oembed')) { $cff_oembed_token = CFF_Oembed::last_access_token();
Exploit Outline
1. The attacker crafts a malicious URL targeting the WordPress admin dashboard, specifically the oEmbeds manager page (`wp-admin/admin.php?page=sbi-oembeds-manager`). 2. The URL includes parameters like `sbi_access_token` and `transfer` set to values controlled by the attacker. 3. The attacker tricks a logged-in administrator (with `manage_options` or `manage_instagram_feed_options` capabilities) into clicking this link. 4. When the administrator's browser loads the page, the plugin's `maybe_connection_data` (or equivalent token-processing logic) detects the GET parameters. 5. Because version 6.11.1 lacks nonce validation for the `sbi_con` parameter, the plugin accepts the data and updates the `sbi_oembed_token` or `cff_oembed_token` WordPress options with the attacker's provided token.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.