The Easy Social Feed – Social Photos Gallery and Post Feed for WordPress plugin (versions up to 6.5.4) contains a CSRF vulnerability due to improper nonce validation in the save_groups_list function. This flaw allows an attacker to perform unauthorized actions by leveraging the trust of an authenticated administrator who is tricked into clicking a crafted link. Specifically, the attacker can disconnect the site's linked Facebook or Instagram accounts without direct authentication. The vulnerability is publicly documented as CVE-2024-1214 with a medium CVSS score of 4.3. No patch or vendor advisory information is currently available to confirm remediation status.

Successful exploitation allows an attacker to disconnect the site's Facebook or Instagram page/group connections by tricking an administrator into performing an action. This results in limited impact affecting the integrity of social media integrations but does not compromise confidentiality or availability of the site. There is no indication of data theft or site takeover from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the vulnerable plugin temporarily may reduce risk.