CVE-2024-1685

The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. CVE-2024-2721 is likely a duplicate to this issue.

• CWE-502
• CWE-502

• https://plugins.trac.wordpress.org/browser/social-media-builder/trunk/classes/SgmbButton.php#L32Broken Link, Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9c17d18a-090f-4b35-a257-cfc0a16d5459?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/social-media-builder/trunk/classes/SgmbButton.php#L32Broken Link, Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9c17d18a-090f-4b35-a257-cfc0a16d5459?source=cveThird Party Advisory

Published

Mar 16, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1679The Print Labels with Barcodes. Create price tags, product l…5.4
• CVE-2024-1680The Premium Addons for Elementor plugin for WordPress is vul…5.4
• CVE-2024-1681corydolphin/flask-cors is vulnerable to log injection when t…5.3
• CVE-2024-1682An unclaimed Amazon S3 bucket, 'codeconf', is referenced in …4.3
• CVE-2024-1683 A DLL injection vulnerability exists where an authenticated…7.3
• CVE-2024-1684The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenb…5.4
• CVE-2024-1686The Thank You Page Customizer for WooCommerce – Increase You…4.3
• CVE-2024-1687The Thank You Page Customizer for WooCommerce – Increase You…5.4
• CVE-2024-1688The Woo Total Sales plugin for WordPress is vulnerable to un…5.3
• CVE-2024-1689The WooCommerce Tools plugin for WordPress is vulnerable to …4.3
• CVE-2024-1690The TeraWallet – Best WooCommerce Wallet System With Cashbac…4.3
• CVE-2024-1691The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenb…6.1