CVE-2024-0780 is a high severity (CVSS 8.8) missing authorization flaw in the Enjoy Social Feed WordPress plugin through version 6.2.2. Any logged in user, even a subscriber, can reset the plugin's database. Update to a release later than 6.2.2 or remove the plugin.
What's affected
The Enjoy Social Feed plugin for WordPress, through version 6.2.2. The record says the plugin does not check authorization when resetting its database, so any authenticated user, such as a subscriber, can perform the action.
The record lists a WPScan page as its only reference and names no fixed version. Check the plugin's changelog for the first release after 6.2.2.
The record classifies the weakness as CWE-862 (missing authorization). NVD scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Plugins are the usual blind spot on a WordPress estate, so start with an inventory. If you have shell access and WP-CLI, this lists every plugin with its version and status:
wp plugin list --fields=name,status,version,update
Look for Enjoy Social Feed in the output and compare the version to the range above. Without WP-CLI, open Plugins in the dashboard and read the version under the plugin name. Do this on every site, including staging copies and old multisite installs, because inactive plugins still sit on disk and some can be reached directly by URL.
The free in-browser dependency scan covers application dependencies in your repositories. It does not read a live WordPress install, so use the plugin list for this one.
What to do now
- Check the plugin version on every site and update if a release later than 6.2.2 is available.
- If no fixed release is offered, deactivate and delete the plugin. Keep the social feed functionality elsewhere if you need it.
- Review whether your site lets anyone register. Open registration widens the group that can reach this action.
- Back up the database so a reset can be reversed.
Why it matters
Missing authorization (CWE-862) means a function never asks who is calling. WordPress offers capability checks for this, and a database reset should require an administrator. Without the check, the lowest account level is enough.
The effect is loss of the plugin's data and settings. The score is high because the privilege needed is minimal and the action is destructive.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Try it yourself
Plugin flaws like this one arrive constantly. This demo shows how findings are triaged and tracked until they are closed.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to worry if registration is closed?
Less so, but not zero. Any existing subscriber or contributor account could still use the action, so review your user list.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
