Medium severity5.9NVD Advisory· Published Sep 27, 2026· Updated Sep 28, 2026
CVE-2026-97227
CVE-2026-97227
Description
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.4.8
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)Wordfence Blog · Oct 1, 2026
- WordPress: 25 Plugin Vulnerabilities Disclosed Together, Including Critical FlawsVypr Intelligence · Sep 27, 2026