Simple Social Media Share Buttons – Social Sharing for Everyone <= 6.2.0 - Cross-Site Request Forgery
Plattform
wordpress
Komponente
simple-social-buttons
Behoben in
6.2.1
6.2.1
CVE-2026-34904 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting the Simple Social Media Share Buttons plugin for WordPress. A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, such as a site administrator, if they can trick the user into clicking a malicious link. This vulnerability impacts versions of the plugin up to and including 6.2.0, and a patch is available in version 6.2.1.
Erkenne diese CVE in deinem Projekt
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Auswirkungen und Angriffsszenarien
The primary impact of this CSRF vulnerability is the potential for unauthorized actions to be performed on a WordPress site by an attacker. By crafting a malicious link and tricking an administrator into clicking it, an attacker could potentially modify site settings, add or remove users, or perform other administrative tasks without proper authentication. The blast radius is limited to the scope of actions an administrator can perform, but the consequences could be significant depending on the site's functionality and data sensitivity. Successful exploitation requires the administrator to be actively logged in and interact with the malicious link, making social engineering a key component of the attack.
Ausnutzungskontext
CVE-2026-34904 was publicly disclosed on 2026-04-07. There are currently no known public proof-of-concept exploits available. The vulnerability is not listed on the CISA KEV catalog at the time of writing. The medium CVSS score reflects the relatively low attack complexity, requiring administrator interaction, but the potential impact of unauthorized administrative actions.
Bedrohungsanalyse
Exploit-Status
EPSS
0.02% (5% Perzentil)
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Keine — ohne Authentifizierung ausnutzbar. Keine Zugangsdaten erforderlich.
- User Interaction
- Erforderlich — Opfer muss eine Datei öffnen, auf einen Link klicken oder eine Seite besuchen.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Niedrig — Angreifer kann einige Daten mit begrenztem Umfang ändern.
- Availability
- Keine — kein Verfügbarkeitseinfluss.
Betroffene Software
Paketinformationen
- Aktive Installationen
- 20KBekannt
- Plugin-Bewertung
- 4.8
- Erfordert WordPress
- 4.0+
- Kompatibel bis
- 6.9.4
- Erfordert PHP
- 5.6+
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
- Geändert
- EPSS aktualisiert
Mitigation und Workarounds
The primary mitigation for CVE-2026-34904 is to immediately upgrade the Simple Social Media Share Buttons plugin to version 6.2.1 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing stricter input validation and output encoding practices within the plugin's code to reduce the risk of CSRF attacks. While a WAF might offer some protection, it's not a substitute for patching the vulnerable plugin. There are no specific Sigma or YARA rules readily available for this particular vulnerability, but general CSRF detection rules can be applied.
So beheben
Aktualisieren Sie auf Version 6.2.1 oder eine neuere gepatchte Version
CVE-Sicherheitsnewsletter
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
Häufig gestellte Fragenwird übersetzt…
What is CVE-2026-34904 in Simple Social Media Share Buttons – Social Sharing for Everyone?
A CSRF (Cross-Site Request Forgery) attack tricks an authenticated user into performing unwanted actions in a web application.
Am I affected by CVE-2026-34904 in Simple Social Media Share Buttons – Social Sharing for Everyone?
The update fixes the vulnerability that allows attackers to perform unauthorized actions on your website.
How do I fix CVE-2026-34904 in Simple Social Media Share Buttons – Social Sharing for Everyone?
Implement additional security measures, such as restricting administrative access and using a security plugin.
Is CVE-2026-34904 being actively exploited?
Educate your administrators about CSRF risks and how to identify suspicious links or websites.
Where can I find the official Simple Social Media Share Buttons – Social Sharing for Everyone advisory for CVE-2026-34904?
There are WordPress security plugins that offer CSRF protection and can help detect suspicious activity.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.