CVE-2024-0779
📋 TL;DR
The Enjoy Social Feed WordPress plugin through version 6.2.2 lacks proper authorization and CSRF protection on admin_init functions, allowing unauthenticated attackers to disconnect users' Instagram accounts. This affects all WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- Enjoy Social Feed WordPress Plugin
📦 What is this software?
Enjoy Social Feed by Mediabetaprojects
⚠️ Risk & Real-World Impact
Worst Case
Attackers could disconnect all users' Instagram integrations, potentially disrupting social media functionality and causing service disruption.
Likely Case
Malicious actors disconnecting Instagram accounts from user profiles, causing inconvenience and potential loss of social media integration.
If Mitigated
Limited impact with proper network segmentation and monitoring, though functionality could still be disrupted.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerable functions without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.3 or later
Vendor Advisory: https://wpscan.com/vulnerability/ced134cf-82c5-401b-9476-b6456e1924e2/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Enjoy Social Feed plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and remove plugin
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate the Enjoy Social Feed plugin
wp plugin deactivate enjoy-instagram-feed
Restrict Admin Access
allBlock access to admin_init endpoints via web application firewall
🧯 If You Can't Patch
- Implement web application firewall rules to block unauthorized access to admin_init endpoints
- Monitor for unusual requests to plugin endpoints and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Enjoy Social Feed version numberCheck Version:
wp plugin get enjoy-instagram-feed --field=versionVerify Fix Applied:
Verify plugin version is 6.2.3 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to admin_init endpoints from unauthenticated IPs
- Multiple Instagram disconnect events
Network Indicators:
- HTTP requests to /wp-admin/admin-post.php with action parameters related to Instagram disconnection
SIEM Query:
source="web_server" AND (uri_path="/wp-admin/admin-post.php" OR uri_path="/wp-admin/admin-ajax.php") AND (http_method="POST" AND (param_action="unlink_instagram" OR user_agent="*" AND status_code=200 AND auth_status="unauthenticated"))