Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery

Successful exploitation of this CSRF vulnerability could allow an attacker to modify the Sosh Share Buttons plugin's configuration without authentication. This could lead to various consequences depending on the plugin's functionality. For example, an attacker might alter the sharing destinations, redirect users to malicious sites, or inject unwanted code. The impact is amplified if the plugin is heavily used or integrated with other critical site components. While the vulnerability requires administrator interaction, social engineering tactics like phishing emails or malicious links can be employed to achieve this.

WordPress websites using the Sosh Share Buttons plugin, particularly those with shared hosting environments or where administrators are susceptible to phishing attacks, are at risk. Sites with outdated plugin versions are especially vulnerable.

• wordpress / composer / npm:

grep -r 'admin_page_content' /var/www/html/wp-content/plugins/sosh-share-buttons/

• wordpress / composer / npm:

wp plugin list | grep 'sosh-share-buttons'

• wordpress / composer / npm:

wp plugin update sosh-share-buttons --all

1. 2026-01-14Disclosure

   disclosure

1. Reserviert2025-12-30
2. Veröffentlicht2026-01-14
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-15377 is to upgrade the Sosh Share Buttons plugin to a version that includes the necessary nonce validation. Since a fixed version is not specified, contact the plugin developer for an updated release. As a temporary workaround, implement a Web Application Firewall (WAF) rule to filter out suspicious requests targeting the 'adminpagecontent' function. Regularly review plugin settings for any unauthorized changes. Consider disabling the plugin if immediate upgrade is not possible.