Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() method hooked to admin_menu in all versions up to, and including, 4.5.8. This is due to the method performing wp_insert_post() and update_post_meta() calls to create a sharing configuration without verifying the current user has administrator-level capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings, which causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-4063 - WPZOOM Social Icons Widget & Block Unauthenticated Data Modification Vulnerability Intel Report: https://ift.tt/IeHVCdX
Post summary
The alert announces CVE-2026-4063, an unauthenticated data modification vulnerability affecting the WPZOOM Social Icons Widget, and points to an Intel Report for further details.
CVE-2026-4063 The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item() … https://www.cve.org/CVERecord?id=CVE-2026-4063
Post summary
A new CVE (CVE-2026-4063) has been disclosed for the WPZOOM Social Icons Widget & Block, revealing that a missing capability check in add_menu_item() permits unauthorized data modification.