Critical severity9.8NVD Advisory· Published Jun 7, 2023· Updated Jun 17, 2026

CVE-2021-4362

Description

The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Kiwi Social Sharellm-fuzzy
Range: =2.1.0
Package: https://wordpress.org/plugins/kiwi-social-share
wpkube/Social Sharing Plugin – Kiwiv5
Range: 2.1.0

Patches

Vulnerability mechanics

References

blog.nintechnet.com/wordpress-kiwi-social-sharing-plugin-fixed-critical-vulnerability/nvdExploit
www.wordfence.com/threat-intel/vulnerabilities/id/8148b6d0-190a-4b97-8af7-edd6943116d1nvdThird Party Advisory
wordpress.org/plugins/kiwi-social-share/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000