CVE-2026-4063

{"id": "CVE-2026-4063", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-03-13T19:55:13.300", "references": [{"url": "https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.5.8/includes/classes/class-wpzoom-social-sharing-buttons.php#L110", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.5.8/includes/classes/class-wpzoom-social-sharing-buttons.php#L134", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/trunk/includes/classes/class-wpzoom-social-sharing-buttons.php#L110", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3481444%40social-icons-widget-by-wpzoom%2Ftrunk&old=3462717%40social-icons-widget-by-wpzoom%2Ftrunk&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6af64b51-1758-495f-b6d7-364488de9ab8?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter."}, {"lang": "es", "value": "El plugin Social Icons Widget & Block de WPZOOM para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de capacidad en el m\u00e9todo add_menu_item() enganchado a admin_menu en todas las versiones hasta la 4.5.8, inclusive. Esto se debe a que el m\u00e9todo realiza llamadas a wp_insert_post() y update_post_meta() para crear una configuraci\u00f3n de compartici\u00f3n sin verificar que el usuario actual tenga capacidades de nivel de administrador. Esto hace posible que atacantes autenticados, con acceso de nivel de Suscriptor y superior, activen la creaci\u00f3n de una publicaci\u00f3n de configuraci\u00f3n de compartici\u00f3n wpzoom publicada con la configuraci\u00f3n predeterminada de los botones de compartici\u00f3n, lo que provoca que los botones de compartici\u00f3n social se inyecten autom\u00e1ticamente en todo el contenido de las publicaciones en el frontend a trav\u00e9s del filtro the_content."}], "lastModified": "2026-03-16T14:53:46.157", "sourceIdentifier": "security@wordfence.com"}