WordPress Plugin Vulnerabilities

Social Sharing Plugin - Kiwi < 2.0.11 - Arbitrary WordPress Options Update

Description

The plugin allowed unauthenticated attackers to update and read arbitrary WordPress options.

Affects Plugins

Plugin icon
kiwi-social-share
Fixed in 2.0.11

References

URL
https://blog.nintechnet.com/critical-vulnerability-in-wordpress-kiwi-social-sharing-plugin-actively-exploited/
URL
https://plugins.trac.wordpress.org/changeset/1973204/kiwi-social-share/trunk/includes/lib/helpers/class-kiwi-social-share-helper.php?old=1922991&old_path=kiwi-social-share%2Ftrunk%2Fincludes%2Flib%2Fhelpers%2Fclass-kiwi-social-share-helper.php

Miscellaneous

Submitter
Ryan Dewhurst
Submitter twitter
ethicalhack3r
Verified
Yes
WPVDB ID
e387f08d-7c9c-4e54-9e2f-222def11216c

Timeline

Publicly Published
2018-11-12 (about 7 years ago)
Added
2018-12-07 (about 7 years ago)
Last Updated
2026-05-04 (about 9 days ago)

Other

Published
Title
Published
2016-12-31
Title
XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal
Published
2018-03-02
Title
NextGEN Gallery < 2.2.50 - Galley Paths Not Secured
Published
2026-02-17
Title
Brevo < 3.3.1 - Unauthenticated Authorization Bypass via Type Juggling
Published
2021-06-07
Title
Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass
Published
2010-12-15
Title
Cforms & CformsII <= 14.10.1 - CAPTCHA Bypass