CVE-2024-1685: Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection
The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. CVE-2024-2721 is likely a duplicate to this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1685?
CVE-2024-1685 is rated as a high-severity vulnerability due to the potential for PHP Object Injection and exploitation by authenticated attackers.
How do I fix CVE-2024-1685?
To fix CVE-2024-1685, update the Social Media Share Buttons plugin to version 2.1.1 or later.
Who is affected by CVE-2024-1685?
CVE-2024-1685 affects all versions of the Social Media Share Buttons plugin for WordPress up to and including version 2.1.0.
What types of attacks can be executed using CVE-2024-1685?
Authenticated attackers with subscriber-level access or higher can exploit CVE-2024-1685 to perform PHP Object Injection attacks.
Which parameter is exploited in CVE-2024-1685?
CVE-2024-1685 is exploited through the deserialization of untrusted input via the attachmentUrl parameter.