CVE-2023-6883: easysocialfeed easy_social_feed
Vulnerability summary
CVE-2023-6883 is a medium (CVSS 4.3) vulnerability in easysocialfeed easy_social_feed. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.8% of scored vulnerabilities.
Timeline
- 11-01-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's Facebook and Instagram access tokens and updating group IDs.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Easysocialfeed1 product
- easy_social_feed≤ 6.5.2
Sjaved1 product
Wordpress1 product
- easy-facebook-likebox≤ 6.5.2 (fixed in 6.5.3)
3 vendors · 3 products
References
3 links- www.wordfence.com/threat-intel/vulnerabilities/id/3deee9b5-2e36-447d-a492-e22e3dc6a5ab?source=cveProductThird Party Advisory