Vulnerability · Published Nov 7, 2026 · Assigned by Patchstack

CVE-2026-122675WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Medium 5.4

In plain English

A medium-severity cross-site request forgery in Wp Social from Wpmet. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.

Affected products (as reported)

Vendor	Product	Versions
Wpmet	Wp Social	0 – through 3.2.3

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://patchstack.com/database/wordpress/plugin/wp-social/vulnerability/wordpress-wp-social-plugin-3-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry