The xShare WordPress plugin includes a reset function that lacks a required nonce check, creating a Cross‑Site Request Forgery vulnerability. An attacker can fabricate a request that, when an administrator clicks a link, causes the plugin’s configuration to be reset. This loss of settings can lead to loss of functionality or expose the site to further attacks if the plugin settings control security‑relevant parameters.

Vendors and products affected are the xShare plugin developed by anwerashif, used in WordPress installations. All released versions up to and including 1.0.1 are vulnerable, as the CSRF check is absent in those builds.

The CVSS score of 4.3 indicates a medium severity, and the EPSS score of less than 1% points to a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Based on the description it is inferred that the attack requires the victim to be an administrative user who is tricked into clicking a malicious link; the attacker can then trigger the reset without needing further authentication beyond the victim's session. This makes the vulnerability more exploitable in environments where administrators are not vigilant, but overall risk remains moderate due to the low availability of prepared exploit code.