CVE-2023-5070 in Social Media Share Buttons & Social Sharing Icons Plugin
Summary
by MITRE • 10/25/2023
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-5070 affects the Social Media Share Buttons & Social Sharing Icons plugin for WordPress, a widely used tool for integrating social media sharing functionality into wordpress websites. This particular vulnerability resides in the sfsi_save_export function within plugin versions up to and including 2.8.5, creating a critical security gap that exposes sensitive configuration data. The flaw represents a significant concern for wordpress site administrators who rely on this plugin for social media integration, as it fundamentally undermines the security posture of websites using affected versions.
The technical implementation of this vulnerability stems from inadequate access controls within the sfsi_save_export function, which fails to properly authenticate or authorize user requests before allowing sensitive data export operations. This function, designed to facilitate data export capabilities for legitimate administrative purposes, lacks proper permission checks that would normally restrict such operations to authorized administrators only. The flaw allows any authenticated user with subscriber-level privileges to execute the export function and retrieve plugin configuration data that contains critical authentication credentials, including social media API tokens, secrets, and application passwords. This represents a classic case of insufficient authorization controls where the system fails to properly validate user privileges before executing sensitive operations.
The operational impact of this vulnerability extends far beyond simple information disclosure, as the exported data includes authentication tokens that can be immediately exploited by attackers to gain unauthorized access to social media accounts and associated services. When an attacker successfully exploits this vulnerability, they can obtain access to social media platform credentials, potentially enabling them to post content, modify account settings, or access private user data through the compromised social media accounts. This exposure creates a cascading security risk where a single vulnerable plugin can provide attackers with access to multiple social media platforms that may be configured through the wordpress site's social sharing plugin. The vulnerability also poses risks to the broader wordpress ecosystem, as these tokens often have broad permissions and can be used to access additional services that may not be directly related to the social media platforms themselves.
Mitigation strategies for CVE-2023-5070 should prioritize immediate action to upgrade the affected plugin to a patched version that properly implements access controls and authentication checks. System administrators should also implement additional monitoring to detect unauthorized export operations and review user permissions to ensure that only trusted administrators have access to sensitive functions. The vulnerability aligns with CWE-284, which addresses improper access control issues, and demonstrates characteristics consistent with ATT&CK technique T1566 related to credential harvesting through social engineering and system exploitation. Organizations should also consider implementing network-based controls such as web application firewalls to detect and block suspicious export requests, while maintaining comprehensive audit logging to track all export operations and user activities within the plugin's administrative interface. Regular security assessments and penetration testing should be conducted to identify similar authorization gaps in other plugins and themes that may be vulnerable to similar access control flaws.