The Sosh Share Buttons plugin for WordPress is vulnerable because the admin_page_content function does not validate a nonce before processing settings changes. This missing check allows an unauthenticated attacker to send a forged request that updates the plugin’s configuration when the administrator is tricked into clicking a link. The primary impact is that an attacker can alter the share button settings, potentially redirecting users to malicious destinations or changing displayed content, and it is classified as CWE‑352.

WordPress sites that have installed the Sosh Share Buttons plugin version 1.1.0 or older. All users of these versions are affected because the vulnerability exists in every release up to and including 1.1.0.

The CVSS score of 4.3 reflects moderate impact, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, so no known widespread exploit activity is reported. The most likely attack vector involves social engineering: an attacker crafts a link that, when clicked by a site administrator, submits a request that the plugin accepts and applies the new settings.