CVE-2024-3228 Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure

Q: What is CVE-2024-3228?

CVE-2024-3228 is a medium-severity vulnerability in wpkube Social Sharing Plugin – Kiwi, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2024-3228 being exploited?

There is no known exploitation of CVE-2024-3228 in the wild and no public exploit code.

Q: How do I fix CVE-2024-3228?

No fix has been published for CVE-2024-3228 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 9 Jul 2024 Updated 8 Apr 2026

Unauthenticated attackers can view limited content from password-protected posts via the Kiwi Social Sharing plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3228?

CVE-2024-3228 is a medium-severity vulnerability in wpkube Social Sharing Plugin – Kiwi, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.

Weakness: CWE-200

Which versions are affected by CVE-2024-3228?

It affects 1 product.

Products include Wpkube Kiwi Social Share.

How do I fix CVE-2024-3228?

No fix has been published for CVE-2024-3228 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3228 being exploited?

There is no known exploitation of CVE-2024-3228 in the wild and no public exploit code.

CVE-2021-4362 Missing authorization in Social Sharing Plugin – Kiwi Critical 9.8

Sources

Also known as GHSA-488w-32fr-3cvp.