SQL Injection Vulnerability in Social Media Auto Post Plugin by WordPress

CVE-2026-93904

What is CVE-2026-93904?

The Social Media Auto Post plugin for WordPress is susceptible to SQL injection via the 'exclude_posts' parameter, affecting all versions up to 4.1.12. Due to inadequate escaping of user input and a poorly prepared SQL query, unauthenticated attackers can potentially inject additional SQL commands into existing queries. This vulnerability is further exacerbated on new installations where the HMAC authentication mechanism can be bypassed. If the settings page is not visited by an administrator, the secret_key remains empty, allowing attackers to generate a valid token with ease. As a result, sensitive information could be extracted from the underlying database, posing a significant security risk.

References