PT-2022-13289 · WordPress · The Professional Social Sharing Buttons

Brandon James Roldan + 1 · Published 2022-07-25 · Updated 2022-11-05 · CVE-2022-0594

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin versions prior to 9.7.6

Description The issue is related to a lack of proper authorization check in one of the AJAX actions, allowing unauthorized access to retrieve sensitive information such as the list of active plugins and various version details like PHP, cURL, and WP. This affects unauthenticated users in versions prior to 9.7.5 and author+ users in version 9.7.5.

Recommendations For versions prior to 9.7.6, update to version 9.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable AJAX action until a patch is available.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-0594

Affected Products

The Professional Social Sharing Buttons

References · 4

• 🔥 https://wpscan.com/vulnerability/4de9451e-2c8d-4d99-a255-b027466d29b1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0594 · Security Note
• https://t.me/cibsecurity/46901 · Telegram Post