Missing authorization in wpzoom Social Icons Widget & Block – Social Media Icons & Share…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4063
- 2026-10-03 Alias added: GHSA-5xh8-vh3c-9fxf
References
Other 5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6af64b51-1758-495f-b6d7-364488de9ab8?source=cve
- https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/trunk/includes/classes/class-wpzoom-social-sharing-buttons.php#L110
- https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.5.8/includes/classes/class-wpzoom-social-sharing-buttons.php#L110
- https://plugins.trac.wordpress.org/browser/social-icons-widget-by-wpzoom/tags/4.5.8/includes/classes/class-wpzoom-social-sharing-buttons.php#L134
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3481444%40social-icons-widget-by-wpzoom%2Ftrunk&old=3462717%40social-icons-widget-by-wpzoom%2Ftrunk&sfp_email=&sfph_mail=
More wpzoom vulnerabilities
- TI-2024-02034 Social Icons Widget & Block < 4.2.18 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2022-04385 WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
- TI-2024-04778 WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion CVSS 3.1CRITICAL 9.8
- TI-2024-20190 WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2024-28945 WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.3.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2025-07869 Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation CVSS 3.1HIGH 8.1
Sources
- CVE-2026-4063 · CVE Program
- CVE-2026-4063 · NVD
- FIRST EPSS
- GHSA-5xh8-vh3c-9fxf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences