PT-2018-10716 · Multidots · Multidots Add Social Share Messenger Buttons Whatsapp/Viber

Published 2018-05-31 · Updated 2018-07-02 · CVE-2018-11632

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin version 1.0.8

Description An issue in the plugin allows an attacker to change its settings via a crafted URL, exploiting a CSRF vulnerability in the wp-admin/admin-post.php endpoint. This can be achieved by tricking an admin user into visiting the malicious URL, potentially through spear phishing or social engineering tactics. The whatsapp share setting add update() function lacks a nonce or capability check, making it vulnerable to such attacks.

Recommendations For MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin version 1.0.8, consider disabling the whatsapp share setting add update() function until a patch is available to prevent exploitation. Restrict access to the wp-admin/admin-post.php endpoint to minimize the risk of CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-11632

Affected Products

Multidots Add Social Share Messenger Buttons Whatsapp/Viber

References · 4

• 🔥 http://labs.threatpress.com/cross-site-request-forgery-csrf-in-add-social-share-messenger-buttons-whatsapp-and-viber-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11632 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11632 · Vendor Advisory
• https://wordpress.org/plugins/add-social-share-buttons/#developers · Note