WordPress Plugin Vulnerabilities

Social Sharing Plugin - Kiwi < 2.0.11 - Arbitrary WordPress Options Update

Description

The plugin allowed unauthenticated attackers to update and read arbitrary WordPress options.

Affects Plugins

Plugin icon
kiwi-social-share
Fixed in 2.0.11

References

URL
https://blog.nintechnet.com/critical-vulnerability-in-wordpress-kiwi-social-sharing-plugin-actively-exploited/
URL
https://plugins.trac.wordpress.org/changeset/1973204/kiwi-social-share/trunk/includes/lib/helpers/class-kiwi-social-share-helper.php?old=1922991&old_path=kiwi-social-share%2Ftrunk%2Fincludes%2Flib%2Fhelpers%2Fclass-kiwi-social-share-helper.php

Miscellaneous

Submitter
Ryan Dewhurst
Submitter twitter
ethicalhack3r
Verified
Yes
WPVDB ID
e387f08d-7c9c-4e54-9e2f-222def11216c

Timeline

Publicly Published
2018-11-12 (about 7 years ago)
Added
2018-12-07 (about 7 years ago)
Last Updated
2026-05-04 (about 9 days ago)

Other

Published
Title
Published
2022-05-18
Title
HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure
Published
2015-11-11
Title
BuddyPress <= 2.3.4 - Authenticated Privilege Escalation
Published
2014-11-24
Title
DukaPress <= 2.5.3 - Unauthenticated Path Traversal
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Privilege Escalation
Published
2022-08-08
Title
Stop Spam Comments <= 0.2.1.2 - Access Token Bypass