CSRF in Supsystic Social Share Buttons
CVE-2022-1653
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.004 (33.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Supsystic Social_share_buttons
- Unknown Social Share Buttons By Supsystic — versions 2.2.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-1653?
- CVE-2022-1653 is a medium-severity vulnerability in Supsystic Social Share Buttons, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2022-06-27.
- How severe is CVE-2022-1653?
- Medium severity. CVSS v3 base score is 4.3 out of 10.
- Is CVE-2022-1653 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.