Vulnerability identifier: #VU17475

Vulnerability risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Simple Social Buttons
Web applications / Modules and components for CMS

Vendor: WPBrigade

Description
The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to improper application design flow, chained with lack of permission check. A remote attacker can gain elevated privileges and perform unauthorized actions in WordPress to modify WordPress installation options from the wp_options table that may allows to take over sites by installing backdoors or taking over admin accounts.

Mitigation
Update to version 2.0.22.

Vulnerable software versions

Simple Social Buttons: 2.0.4 - 2.0.21

---

External links
http://www.webarxsecurity.com/wordpress-plugin-simple-social-buttons/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.