Login Sign Up

CVE-2024-3228

5.3 MEDIUM
Authentication Bypass

📋 TL;DR

The Kiwi Social Sharing WordPress plugin has an information disclosure vulnerability that allows unauthenticated attackers to view limited content from password-protected posts. This affects all WordPress sites using Kiwi plugin versions up to 2.1.7. The vulnerability is in the 'kiwi-nw-pinterest' class.

💻 Affected Systems

Products:
  • Kiwi Social Sharing WordPress Plugin
Versions: All versions up to and including 2.1.7
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all WordPress installations with vulnerable Kiwi plugin versions enabled.

📦 What is this software?

Kiwi Social Share by Wpkube

View all CVEs affecting Kiwi Social Share →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sensitive information from password-protected posts could be exposed to unauthorized users, potentially revealing confidential content.

🟠

Likely Case

Limited content snippets from protected posts become accessible to anyone, compromising content privacy controls.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to minor information leakage from protected content.

🌐 Internet-Facing: HIGH
🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Vulnerability allows unauthenticated access to protected content via specific class.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.1.8 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3109786%40kiwi-social-share&new=3109786%40kiwi-social-share

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Kiwi Social Sharing' and click 'Update Now'. 4. Verify plugin version is 2.1.8 or higher.

🔧 Temporary Workarounds

Disable Kiwi Plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate kiwi-social-share

🧯 If You Can't Patch

  • Implement web application firewall rules to block access to vulnerable endpoints
  • Temporarily disable password-protected posts feature

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Kiwi Social Sharing → Version number. If version is 2.1.7 or lower, you are vulnerable.

Check Version:

wp plugin get kiwi-social-share --field=version

Verify Fix Applied:

After updating, confirm plugin version shows 2.1.8 or higher in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

  • Unusual access patterns to password-protected post URLs
  • Requests containing 'kiwi-nw-pinterest' class parameters

Network Indicators:

  • HTTP requests to WordPress endpoints with Kiwi plugin parameters from unauthenticated sources

SIEM Query:

web_access_logs WHERE uri CONTAINS 'kiwi-nw-pinterest' AND status_code = 200 AND auth_status = 'unauthenticated'

📊 Metadata

CVE ID: CVE-2024-3228
CVSS v3 Score: 5.3 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: July 9, 2024
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON