CVE-2026-12002 is a CSRF vulnerability in the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress affecting all versions up to and including 6.11.1. The root cause is missing or incorrect nonce validation on the maybe_connection_data function, which handles Instagram and Facebook oEmbed access tokens. An attacker can exploit this by tricking an authenticated site administrator into executing a forged request, resulting in the overwriting of these access tokens. This vulnerability does not require the attacker to have privileges but relies on user interaction (UI:R). The impact is limited to integrity loss (I:L) without confidentiality or availability impact. No official patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker can overwrite the site's Instagram and Facebook oEmbed access tokens by exploiting the CSRF vulnerability, potentially disrupting or manipulating the social media feeds displayed on the site. There is no direct confidentiality or availability impact reported. The integrity of the social feed tokens is compromised, which could lead to unauthorized content display or feed manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on untrusted links while logged into the WordPress admin interface. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches addressing this CSRF vulnerability.