// For flags

CVE-2018-11632

Add Social Share Buttons for Whatsapp and Viber < 1.1 - Cross-Site Request Forgery

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.

Se ha descubierto un problema en el plugin Add Social Share Messenger Buttons Whatsapp and Viber 1.0.8 de MULTIDOTS para WordPress. Si se puede engañar a un usuario administrador para que visite una URL manipulada creada por un atacante (mediante phishing dirigido o ingeniería social), el atacante puede cambiar la configuración del plugin mediante Cross-Site Request Forgery (CSRF) en wp-admin/admin-post.php. No existen verificaciones de nonce o capability en la función whatsapp_share_setting_add_update().

*Credits: ThreatPress
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-05-30 CVE Published
  • 2018-05-31 CVE Reserved
  • 2024-09-16 CVE Updated
  • 2024-09-16 First Exploit
  • 2024-09-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Multidots
Search vendor "Multidots"
 Add Social Share Messenger Buttons Whatsapp And Viber
Search vendor "Multidots" for product "Add Social Share Messenger Buttons Whatsapp And Viber"
 1.0.8
Search vendor "Multidots" for product "Add Social Share Messenger Buttons Whatsapp And Viber" and version "1.0.8"
wordpress
Affected