Vulnerability in Social Media Share Buttons Plugin for WordPress Allows PHP Object Injection

CVE-2024-1685

What is CVE-2024-1685?

The Social Media Share Buttons plugin for WordPress contains a vulnerability that enables PHP Object Injection through the deserialization of untrusted input via the attachmentUrl parameter. This flaw affects all versions up to and including version 2.1.0. Attackers with subscriber-level or higher access can potentially inject a PHP Object, which, while lacking a known payload, could be exploited if other vulnerable plugins or themes are present. Exploitation may lead to unauthorized actions, including the deletion of arbitrary files, retrieval of sensitive information, or execution of malicious code.

References