Spotlight Social Feeds [Block, Shortcode, and Widget] Vulnerability – Cross-Site Request Forgery – CVE-2024-31381 | WordPress Plugin Vulnerability Report

Plugin Name: Spotlight Social Feeds [Block, Shortcode, and Widget]

Key Information:

  • Software Type: Plugin
  • Software Slug: spotlight-social-photo-feeds
  • Software Status: Active
  • Software Author: rebelcode
  • Software Downloads: 1,093,293
  • Active Installs: 60,000
  • Last Updated: April 22, 2024
  • Patched Versions: 1.6.11
  • Affected Versions: <= 1.6.10

Vulnerability Details:

  • Name: Spotlight Social Media Feeds <= 1.6.10
  • Title: Cross-Site Request Forgery
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-31381
  • CVSS Score: 4.3
  • Publicly Published: April 10, 2024
  • Researcher: Majed Refaea
  • Description: The Spotlight Social Media Feeds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.10. This vulnerability stems from missing or incorrect nonce validation in the AuthCallbackListener class, enabling unauthenticated attackers to connect accounts through a forged request if they can trick a site administrator into clicking a link.


The Spotlight Social Feeds plugin for WordPress has a vulnerability in versions up to and including 1.6.10 that allows attackers to forge requests to connect social media accounts without proper authorization. This vulnerability has been patched in version 1.6.11.

Detailed Overview:

The vulnerability in the Spotlight Social Feeds plugin was discovered by researcher Majed Refaea and involves a critical issue in the AuthCallbackListener class where nonce validation is either missing or incorrect. This flaw permits attackers to execute unauthorized account connections via CSRF. By exploiting this vulnerability, attackers could potentially manipulate social media content or access sensitive information relayed through these connections. The immediate risk is the unauthorized linking of social media accounts, but the broader implications could include unauthorized access to personal or business social media data. This issue has been addressed in the recently released patch.

Advice for Users:

  • Immediate Action: Users are encouraged to update to the patched version, 1.6.11, without delay.
  • Check for Signs of Vulnerability: Administrators should review their site logs for unexpected social media account connections that could indicate exploitation of this vulnerability.
  • Alternate Plugins: Considering alternative social media feed plugins might be wise if ongoing security concerns persist.
  • Stay Updated: Keeping plugins updated is crucial. Always ensure your WordPress plugins are running the latest versions to mitigate security risks.


The quick and effective response by Spotlight Social Feeds developers to address this vulnerability illustrates the importance of rapid action in the digital security realm. Users should prioritize updating to version 1.6.11 or later to protect their WordPress installations from potential CSRF attacks.


Detailed Report: 

In the digital realm, the security of your website hinges on the robustness of each component that builds your online presence, especially on platforms as widely utilized as WordPress. The recent vulnerability identified in the Spotlight Social Feeds plugin—a popular tool that integrates social media content into WordPress sites—brings to the forefront an ongoing challenge: the need for vigilance and regular updates. This particular issue, tagged as CVE-2024-31381, exposes sites to Cross-Site Request Forgery (CSRF), allowing attackers to exploit weak nonce validation to forge requests under the guise of legitimate user actions.

Risks and Potential Impacts:

The vulnerability allows attackers to perform unauthorized actions such as connecting social media accounts without the administrator's consent. This not only compromises the security of the website but also risks spreading misinformation or unauthorized content through connected social media channels. For small business owners, such breaches can damage customer trust and brand reputation, which are often difficult and costly to restore.

Previous Vulnerabilities:

Since March 4, 2022, there have been three previous vulnerabilities reported for the Spotlight Social Feeds plugin. This history underscores the necessity for regular updates and monitoring of this plugin to protect your site from emerging threats.


The prompt response by Spotlight Social Feeds developers to the CSRF vulnerability highlights the importance of timely updates in the digital security realm. For small business owners managing WordPress sites, it is essential to keep all components, especially plugins, updated to the latest versions. Staying on top of these updates can seem daunting, but it is crucial for maintaining the security and integrity of your online presence.

Final Thoughts:

For small business owners, the challenge of staying on top of potential security vulnerabilities can be overwhelming due to time constraints. However, the consequences of neglecting these aspects of your website can be far more time-consuming and expensive in the long run. Implementing automated updates where possible and setting regular reminders to check on the security health of your website can mitigate these risks and help keep your digital presence safe.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Spotlight Social Feeds [Block, Shortcode, and Widget] Vulnerability – Cross-Site Request Forgery – CVE-2024-31381 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment