The WPZOOM Social Icons Widget & Block plugin up to version 4.5.8 contains a missing capability check in its add_menu_item() method. This oversight allows any authenticated WordPress user with Subscriber level or higher to trigger wp_insert_post() and update_post_meta() calls that create a new wpzoom‑sharing configuration post. The newly created configuration is automatically published, and the plugin’s the_content filter injects social sharing buttons into every post’s content on the front‑end. The consequence is unauthorized modification of the site’s content presentation, which can lead to deceptive user experience or unintended disclosure of information. The weakness is a classic authorization flaw, specifically documented as CWE-862.

WordPress sites that have installed the wpzoom:Social Icons Widget & Block – Social Media Icons & Share Buttons plugin with any release up to and including v4.5.8 are affected. The vulnerability resides in the class-wpzoom-social-sharing-buttons.php file, specifically around lines 110 and 134, where the add_menu_item() method is defined. This applies to all users with Subscriber level or higher logging into the WordPress admin area.

The CVSS score of 4.3 reflects a moderate severity with moderate complexity. EPSS indicates an exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated; the attacker simply needs to log in to the back‑end with a Subscriber‑level account (or higher) and invoke the configuration‑creation routine. No additional conditions or external attack prerequisites are described in the available reference material. The exploit can be performed via the admin_menu action hook that triggers plugin configuration creation, and the injected sharing buttons appear immediately on all public posts.