CVE-2024-8352
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.97%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.97% probability · 62th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- hypestudio/social web suite
- Source
- security@wordfence.com
EPSS 1.0% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/libs/class-socialwebsuite-log.php#L78Product
- https://plugins.trac.wordpress.org/changeset/3155593/social-web-suite/trunk?old=3068377&old_path=%2Fsocial-web-suite%2FtrunkPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=cveThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.