Sensitive Information Exposure in Flow-Flow Social Stream by Looks Awesome
CVE-2026-125799

7.5HIGH

Key Information:

Vendor

WordPress
Status
Flow-flow Social Stream
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125799?

A vulnerability exists in the Flow-Flow Social Stream plugin developed by Looks Awesome, allowing sensitive information to be inadvertently exposed through externally accessible files or directories. This issue specifically enables unauthorized retrieval of embedded sensitive data, posing significant risks to user privacy and data security. All users of Flow-Flow Social Stream versions n/a through 5.0.5 should take immediate action to secure their installations.

Affected Version(s)

Flow-Flow Social Stream 0 <= 5.0.5

References

https://patchstack.com/database/wordpress/plugin/flow-flo...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen | Patchstack Bug Bounty Program
.