A missing authorization check in the Social Share Buttons & Analytics Plugin allows an attacker to perform actions that should be restricted to privileged users, leading to unauthorized access. The flaw is a classic broken access control defect classified as CWE‑862, enabling exploitation of incorrect permission enforcement.

The vulnerability affects the WordPress plugin Social Share Buttons & Analytics Plugin – GetSocial.io provided by Joao Romao. Versions from the initial release through 4.5 are impacted; any installation of the plugin prior to or equal to version 4.5 is susceptible.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of <1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves HTTP requests directed at the plugin’s administrative endpoints, exploiting the lack of proper role verification. If an attacker can reach these endpoints, they can gain unauthorized control over plugin settings or possibly higher privileges within WordPress.