CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.
Explanation of Vulnerability in Simple Terms
Sassy Social Share versions 3.3.23 and earlier contain an authorization flaw that allows authenticated users with low privileges to read, modify, or delete data they should not have access to. The vulnerability affects confidentiality, integrity, and availability of site data. Administrators should update to a version newer than 3.3.23 immediately.
What an attacker can do
Read, modify, or delete sensitive site data without proper authorization.
Potential impact on your site
Authenticated users can access or alter data beyond their intended permissions, risking data breach or site defacement.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
