wpzoom Social Icons Widget & Block Plugin up to 4.5.8 on WordPress add_menu_item authorization

Summaryinfo

A vulnerability, which was classified as critical, was found in wpzoom Social Icons Widget & Block Plugin up to 4.5.8 on WordPress. Impacted is the function add_menu_item. Such manipulation leads to authorization. This vulnerability is listed as CVE-2026-4063. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in wpzoom Social Icons Widget & Block Plugin up to 4.5.8 on WordPress. It has been rated as critical. Affected by this issue is the function add_menu_item. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.

The weakness was presented by darkestmode. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-4063 since 03/12/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/14/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-11786). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wpzoom

Name

• Social Icons Widget & Block Plugin

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4
• 4.5.5
• 4.5.6
• 4.5.7
• 4.5.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion