Simple Social Media Share Buttons CVE-2026-34904

Requires victim logged into WordPress site with Analytify Simple Social Media Share Buttons plugin (versions through 6.2.0) installed. Attacker must trick victim into clicking a malicious link or visiting attacker-controlled page.

Real-world exploitation risk is moderate despite the 7.5 CVSS score. The CVSS vector reveals important constraints: attack complexity is HIGH (AC:H) requiring significant social engineering or precise timing, and user interaction is REQUIRED (UI:R), meaning an authenticated administrator must be tricked into visiting an attacker-controlled page while logged into WordPress. The unauthenticated attack vector (PR:N) is partially misleading-while the attacker needs no credentials, the victim must be authenticated for CSRF to succeed. No EPSS score provided, but CSRF vulnerabilities typically show lower exploitation rates than remote code execution flaws due to operational friction. CISA KEV status not indicated, suggesting no confirmed active exploitation campaigns. The SSVC framework would likely classify this as 'attended' rather than 'efficient' exploitation due to the human interaction dependency. Priority should be elevated for WordPress installations with multiple administrators or high-value content, where social engineering success probability increases. Organizations should balance patching urgency against the fact that successful exploitation requires crossing multiple hurdles: identifying vulnerable installations, social engineering authenticated users, and timing attacks during active sessions.

An attacker identifies a WordPress site running Simple Social Media Share Buttons plugin version 6.2.0 and crafts a malicious webpage containing hidden forms that submit requests to the vulnerable plugin's administrative endpoints. The attacker then uses spear-phishing emails or compromised websites frequented by the target site's administrators to deliver the malicious page. When an authenticated WordPress administrator visits the attacker's page while logged into their WordPress dashboard, the hidden forms automatically submit state-changing requests (such as modifying plugin configurations, injecting malicious JavaScript into social sharing buttons, or altering site settings) using the victim's valid session cookies. Because the plugin fails to validate CSRF tokens, these forged requests execute with full administrative privileges, potentially enabling the attacker to establish persistence, deface content, or inject malicious scripts that affect all site visitors interacting with social sharing functionality.