What is the CVSS score of CVE-2026-4063?

CVE-2026-4063 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4063?

Organizations using all should be aware of moderate risk from CVE-2026-4063, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-4063?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-4063

EUVD-2026-11786 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 10:00 euvd

EUVD-2026-11786

Analysis Generated

Mar 13, 2026 - 10:00 vuln.today

CVE Published

Mar 13, 2026 - 09:25 nvd

MEDIUM 4.3

DescriptionCVE.org

The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.

AnalysisAI

The Social Icons Widget & Block by WPZOOM plugin for WordPress contains a missing capability check vulnerability in the add_menu_item() method that allows authenticated users with Subscriber-level access or higher to create and publish wpzoom-sharing configuration posts without administrator verification. This results in unauthorized injection of social sharing buttons into all post content on the frontend, effectively modifying site content through an integrity attack. With a CVSS score of 4.3 and low attack complexity, this vulnerability represents a moderate integrity risk in multiuser WordPress environments where subscriber accounts exist.

Technical ContextAI

The vulnerability exists in the Social Icons Widget & Block by WPZOOM plugin and stems from a missing capability check in the add_menu_item() method, which is hooked to the admin_menu action. The root cause is classified under CWE-862 (Missing Authorization), where the plugin performs wp_insert_post() and update_post_meta() WordPress core functions to create sharing configuration post objects without first validating that the calling user possesses administrator-level capabilities via current_user_can('manage_options'). The vulnerable code path allows any authenticated WordPress user to instantiate a wpzoom-sharing custom post type with default settings that are subsequently rendered via the_content filter hook, injecting social sharing buttons into the post content pipeline without proper authorization controls. This represents a fundamental authorization bypass in a popular WordPress plugin ecosystem component.

RemediationAI

The primary remediation is to upgrade the Social Icons Widget & Block by WPZOOM plugin to version 4.5.9 or later, which incorporates the necessary capability check in the add_menu_item() method. Users should navigate to the WordPress admin dashboard, go to Plugins, and update to the patched version immediately. As an interim mitigation before patching is possible, administrators should review and restrict WordPress user roles, ensuring that Subscriber accounts are only granted to trusted individuals and removing Subscriber access from any untrusted or inactive accounts. Additionally, administrators can implement role-based capability restrictions using WordPress security plugins or custom code to prevent lower-privilege users from triggering plugin-specific actions, though this does not replace the proper patch. Monitor the WordPress plugin repository and WPZOOM's official channels for the security advisory containing the patch release information and apply updates within a maintenance window.