CVE-2021-4362

🗓️ 07 Jun 2023 01:51:28Reported by WordfenceType

The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2021-4362	7 Jun 202302:15	–	attackerkb
CNNVD	WordPress Plugin Kiwi Social Share 安全漏洞	7 Jun 202300:00	–	cnnvd
Cvelist	CVE-2021-4362	7 Jun 202301:51	–	cvelist
EUVD	EUVD-2021-34189	3 Oct 202520:07	–	euvd
NVD	CVE-2021-4362	7 Jun 202302:15	–	nvd
OSV	CVE-2021-4362	7 Jun 202302:15	–	osv
Prion	Authorization	7 Jun 202302:15	–	prion
Positive Technologies	PT-2023-12473 · WordPress · Kiwi Social Share	7 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2021-4362	6 Feb 202504:20	–	redhatcve
Vulnrichment	CVE-2021-4362	7 Jun 202301:51	–	vulnrichment

NVD

Vulners

Node

wpkube kiwi_social_shareMatch2.1.0wordpress

[
  {
    "vendor": "wpkube",
    "product": "Social Sharing Plugin – Kiwi",
    "versions": [
      {
        "version": "2.1.0",
        "status": "affected",
        "lessThanOrEqual": "2.1.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordpress	www.wordpress.org/plugins/kiwi-social-share/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8148b6d0-190a-4b97-8af7-edd6943116d1
blog	www.blog.nintechnet.com/wordpress-kiwi-social-sharing-plugin-fixed-critical-vulnerability/

21 Nov 2024 06:37Current

9.2High risk

Vulners AI Score9.2

CVSS 3.19.8

EPSS0.02999

SSVC

CWE-862