QID 150567

Date Published: 2022-09-12

QID 150567: WordPress Shareaholic Plugin : Information Disclosure Vulnerability (CVE-2022-0594)

Shareaholic is a WordPress plugin which allows users to add Social share buttons, related posts, content analytics, Ad monetization to your website.

Affected versions of Shareaholic plugin does not have proper authorization check in "shareaholic_debug_info" AJAX action, available to unauthenticated users in version prior to 9.7.5 and author and high privilege users in version 9.7.5, allowing them to call it and retrieve sensitive information such as the list of active plugins, various version like PHP, cURL, WordPress etc.

Affected versions:
Shareaholic prior to version 9.7.6

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request with specially crafted payload and based on the response determines vulnerable version of Shareaholic plugin running on the target WordPress application.

Successful exploitation of this vulnerability could reveal sensitive information to an unauthorized attacker.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to upgrade to Shareaholic 9.7.6 to remediate this vulnerability. For more information regarding this vulnerability please refer WPScan Advisory

Vendor References

WPScan Advisory - wpscan.com/vulnerability/4de9451e-2c8d-4d99-a255-b027466d29b1

CVEs related to QID 150567

CVE-2022-0594 |

Software Advisories

Advisory ID	Software	Component	Link
WPScan Advisory			wpscan.com/vulnerability/4de9451e-2c8d-4d99-a255-b027466d29b1

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].