CVE-2018-11632

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress

published May 31, 2018

CVSS
—
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker (via spear phishing/social engineering), the attacker can change the plugin settings via wp-admin/admin-post.php CSRF. There's no nonce or capability check in the whatsapp_share_setting_add_update() function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Published
2018-05-31T20:00Z
EPSS history
Timeline
  • 31 MAY 20:00Z
    An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress
    cvelistv5