Is CVE-2026-65521 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65521 being exploited in the wild.

How severe is CVE-2026-65521?

Medium severity, with a CVSS score of 5.3, published 23 July 2026.

Which products and versions are affected?

WPManageNinja WP Social Ninja <= 4.3.0.

Is there a fix for CVE-2026-65521?

A patch was published on 2026-07-23: Patch released in version 4.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65521 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-65521?

Check whether you run WPManageNinja WP Social Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65521: Mahmudul Hasan Arif WP Social Ninja sensitive data exposure

Q: Is there a fix for CVE-2026-65521?

A patch was published on 2026-07-23: Patch released in version 4.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65521 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-65521?

Check whether you run WPManageNinja WP Social Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65521 · Severity: medium · CVSS 5.3 · Published 2026-07-23

WP Social Ninja is a WordPress plugin used to integrate social media feeds and reviews into websites. A security vulnerability in versions 4.3.0 and earlier allows unauthenticated visitors to access sensitive system information that should be restricted. This exposure could provide attackers with technical details useful for planning more advanced attacks against the website.

Vendors: WPManageNinja.

Quick answers

Is CVE-2026-65521 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65521 being exploited in the wild.
How severe is CVE-2026-65521?: Medium severity, with a CVSS score of 5.3, published 23 July 2026.
Which products and versions are affected?: WPManageNinja WP Social Ninja <= 4.3.0.
Is there a fix for CVE-2026-65521?: A patch was published on 2026-07-23: Patch released in version 4.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65521 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-65521?: Check whether you run WPManageNinja WP Social Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Social Ninja plugin for WordPress is vulnerable to sensitive data exposure (CWE-497) in versions up to and including 4.3.0. The vulnerability allows an unauthenticated remote attacker to access sensitive system information due to insufficient access controls on certain plugin components or endpoints. This data exposure can be leveraged by an attacker to gather intelligence for further exploitation. The issue is resolved in version 4.3.1.

Affected products

Mahmudul Hasan Arif WP Social Ninja <= 4.3.0

Timeline

2026-07-16: other: Reported by researcher Ananda Dhakal
2026-07-23: disclosed: Vulnerability published by Patchstack and NVD
2026-07-23: patched: Patch released in version 4.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.