CVE-2024-9697

MEDIUM

Social Rocket - Social Sharing Plugin <= 1.3.4 - Authenticated Arbitrary Settings Update via Missing Capability Check

Title source: llm
STIX 2.1

Description

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0037
EPSS Percentile 29.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
socialrocket/Social Rocket – Social Sharing Plugin < 1.3.4
wpsocialrocket/social_rocket < 1.3.4
Published Jan 07, 2025
Tracked Since Feb 18, 2026