CVE-2024-31379

The Smash Balloon Social Post Feed plugin for WordPress contained a cross-site request forgery vulnerability that could enable attackers to trick authenticated administrators into performing unintended actions. Researcher Majed Refaea identified the flaw, which allowed malicious actors to exploit user sessions with elevated privileges. The vulnerability was resolved in version 4.2.2 and administrators should upgrade to this version or later to secure their installations.

Based on public CVE data (MITRE/NVD).