CVE-2024-2721 HIGH

CVE-2024-2721: WordPress Social Media Share Buttons plugin <= 2.1.0 - PHP Object Injection vulnerability

Vendor Social Media Share Buttons By Sygnoos
Product Social Media Share Buttons
Weakness CWE-502 · Unsafe deserialization
Published March 20, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Social Media Share Buttons By Sygnoos Social Media Share Buttons.This issue affects Social Media Share Buttons: from n/a through 2.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

Social Media Share Buttons by Sygnoos versions up to 2.1.0 contain a deserialization vulnerability that allows authenticated attackers to execute arbitrary code on the site. The vulnerability requires low-level privileges and network access but no user interaction. Scope is changed, meaning the impact extends beyond the vulnerable component itself.

What an attacker can do

03Attacker Capabilities

Run their own code on the site with the privileges of the authenticated user.

Potential impact on your site

04Site Impact

Compromised site with potential data theft, malware injection, or defacement depending on attacker's account level.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site; network access required.

Key dates

06Disclosure timeline

March 20, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57713 WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability CVE-2026-49768 WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability CVE-2026-9691 WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability CVE-2026-8365 Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field CVE-2026-27053 WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability