Attackers exploited vulnerability in a feature known as “View As”, the social media giant says.