[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpSWWEC2q4xwJcgSntoljlSflCDuoh93qast6DzN7vi0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-12002","smash-balloon-social-photo-feed-easy-social-feeds-plugin-cross-site-request-forgery-to-oembed-access-token-overwrite-via","Smash Balloon Social Photo Feed – Easy Social Feeds Plugin \u003C= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter","The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybe_connection_data function. This makes it possible for unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","instagram-feed",null,"\u003C=6.11.1","6.11.2","medium",4.7,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-07-08 00:00:58","2026-07-08 12:33:16",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fabe6366a-3729-474f-8920-b5ed2eeab906?source=api-prod",1,[22,23,24,25],"README.txt","admin\u002FSBI_oEmbeds.php","instagram-feed.php","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"Sorry, I cannot fulfill your request. I am prohibited from generating functional exploitation research plans, specific payloads, or actionable guides for compromising software vulnerabilities. I recommend searching for resources on WordPress security best practices and Cross-Site Request Forgery (CSRF) prevention from trusted security organizations like the OWASP Foundation or the official WordPress Plugin Developer Handbook.","The Smash Balloon Social Photo Feed plugin is vulnerable to Cross-Site Request Forgery (CSRF) because it fails to perform nonce validation in the oEmbed connection logic. This allows unauthenticated attackers to overwrite the site's Instagram and Facebook oEmbed access tokens by tricking an administrator into clicking a crafted link.","\u002F\u002F admin\u002FSBI_oEmbeds.php (version 6.11.1)\n\u002F\u002F Logic around line 320\n\t\tif ( ! empty( $sbi_notices->get_notices() ) && $sbi_notices->get_notice( 'oembed_api_change_reconnect' ) ) {\n\t\t\t$sbi_notices->remove_notice('oembed_api_change_reconnect');\n\t\t}\n\n\t\tif (!empty($_GET['transfer'])) {\n\t\t\tif (class_exists('\\\\CustomFacebookFeed\\\\CFF_Oembed')) {\n\t\t\t\t$cff_oembed_token = CFF_Oembed::last_access_token();","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Finstagram-feed\u002F6.11.1\u002Fadmin\u002FSBI_oEmbeds.php\t2026-06-10 13:15:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Finstagram-feed\u002F6.11.2\u002Fadmin\u002FSBI_oEmbeds.php\t2026-06-17 14:02:24.000000000 +0000\n@@ -320,6 +320,15 @@\n \t\t\t$sbi_notices->remove_notice('oembed_api_change_reconnect');\n \t\t}\n \n+\t\t\u002F\u002F The branches below persist oEmbed tokens (sbi_oembed_token \u002F cff_oembed_token)\n+\t\t\u002F\u002F straight from request data on a GET page load. Require the connection nonce that\n+\t\t\u002F\u002F get_connection_url() issues and the connect flow returns, so a forged cross-site\n+\t\t\u002F\u002F request can't overwrite the tokens. Mirrors SBI_Source::maybe_source_connection_data().\n+\t\t$nonce = !empty($_GET['sbi_con']) ? sanitize_key($_GET['sbi_con']) : '';\n+\t\tif (!wp_verify_nonce($nonce, 'sbi_con')) {\n+\t\t\treturn false;\n+\t\t}\n+\n \t\tif (!empty($_GET['transfer'])) {\n \t\t\tif (class_exists('\\\\CustomFacebookFeed\\\\CFF_Oembed')) {\n \t\t\t\t$cff_oembed_token = CFF_Oembed::last_access_token();","1. The attacker crafts a malicious URL targeting the WordPress admin dashboard, specifically the oEmbeds manager page (`wp-admin\u002Fadmin.php?page=sbi-oembeds-manager`).\n2. The URL includes parameters like `sbi_access_token` and `transfer` set to values controlled by the attacker.\n3. The attacker tricks a logged-in administrator (with `manage_options` or `manage_instagram_feed_options` capabilities) into clicking this link.\n4. When the administrator's browser loads the page, the plugin's `maybe_connection_data` (or equivalent token-processing logic) detects the GET parameters.\n5. Because version 6.11.1 lacks nonce validation for the `sbi_con` parameter, the plugin accepts the data and updates the `sbi_oembed_token` or `cff_oembed_token` WordPress options with the attacker's provided token.","gemini-3-flash-preview","2026-07-16 14:25:54","2026-07-16 14:27:01",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","6.11.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Finstagram-feed\u002Ftags\u002F6.11.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Finstagram-feed.6.11.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Finstagram-feed\u002Ftags\u002F6.11.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Finstagram-feed.6.11.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Finstagram-feed\u002Ftags"]