Information Disclosure in Social Media Share Buttons WordPress Plugin

The 'Social Media Share Buttons & Social Sharing Icons' WordPress plugin (versions 2.8.5 and earlier) contains an information exposure vulnerability identified as CVE-2023-5070. The vulnerability stems from insecure handling within the sfsi_save_export function. An authenticated user, such as a low-privileged subscriber, can invoke this function to trigger a full export of the plugin's configuration settings. This exported data includes highly sensitive information, such as third-party social media authentication tokens, application secrets, and stored service passwords. Because these credentials are often utilized for administrative or automated integration with social platforms, their disclosure poses a significant risk of account compromise or unauthorized third-party access. Defenders should identify any instances of this plugin in their environment and ensure they are updated to version 2.8.6 or later.

Impact

Successful exploitation allows unauthorized users to retrieve sensitive third-party service credentials and API tokens. This could lead to the hijacking of connected social media accounts, unauthorized data access, or the use of leaked credentials to gain persistence or facilitate further attacks within connected ecosystems.

Recommendation

• Update 'Social Media Share Buttons & Social Sharing Icons' to version 2.8.6 or later immediately to patch CVE-2023-5070.
• Audit logs for unauthorized usage of the sfsi_save_export function or irregular access to the WordPress admin-ajax interface by low-privileged user accounts.
• Rotate all social media API keys and secrets that were configured within the plugin if the environment was exposed prior to patching.