CVE Database /
CVE-2025-49937
CVE · Medium
CVE-2025-49937 — Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.3.3
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-49937
|
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed] < 4.3.3 |
Missing Authorization |
Medium
4.3
|
< 4.3.3
|
4.3.3 |
2025-10-09 |
—
|
CVE-2025-49937
The Smash Balloon Social Post Feed plugin for WordPress contains a security flaw that allows users with certain permissions to bypass intended restrictions on its functionality in all versions prior to 4.3.2. This vulnerability enables authenticated individuals with elevated account status to execute actions they shouldn't be able to perform. The issue is present across the entire affected range of plugin versions.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings