CVE-2024-0779 Enjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking

2024-03-1819:05:42

WPScan

www.cve.org

cve-2024-0779

enjoy social feed

unauthenticated

account unlinking

wordpress plugin

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Enjoy Social Feed plugin for WordPress website",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "6.2.2"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/