CVE-2021-4362

The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version.

• CWE-862

• https://blog.nintechnet.com/wordpress-kiwi-social-sharing-plugin-fixed-critical-vulnerability/Exploit
• https://wordpress.org/plugins/kiwi-social-share/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8148b6d0-190a-4b97-8af7-edd6943116d1?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-kiwi-social-sharing-plugin-fixed-critical-vulnerability/Exploit
• https://wordpress.org/plugins/kiwi-social-share/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8148b6d0-190a-4b97-8af7-edd6943116d1?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43612In lldpd before 1.0.13, when decoding SONMP packets in the s…7.5
• CVE-2021-43615An issue was discovered in HddPassword in Insyde InsydeH2O w…8.2
• CVE-2021-43616The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds…9.8
• CVE-2021-43617Laravel Framework through 8.70.2 does not sufficiently block…9.8
• CVE-2021-43618GNU Multiple Precision Arithmetic Library (GMP) through 6.2.…7.5
• CVE-2021-43619Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow…7.8
• CVE-2021-43620An issue was discovered in the fruity crate through 0.2.0 fo…7.5
• CVE-2021-43628Projectworlds Hospital Management System v1.0 is vulnerable …9.8
• CVE-2021-43629Projectworlds Hospital Management System v1.0 is vulnerable …9.8
• CVE-2021-4363The WP Quick FrontEnd Editor plugin for WordPress is vulnera…6.1
• CVE-2021-43630Projectworlds Hospital Management System v1.0 is vulnerable …8.8
• CVE-2021-43631Projectworlds Hospital Management System v1.0 is vulnerable …9.8