Social Icons Widget & Block <= 4.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure via AI Chat Identity Signature
- ID
- WPSEC-2026-0261
- Plugin
- WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons (social-icons-widget-by-wpzoom)
- Affected
- from 4.7.1 before 4.7.4
- Remediation
- Update to 4.7.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-347
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Social Icons Widget & Block on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-100149, on 2026-10-02.
Description
The Social Icons Widget & Block (WPZOOM Connect) plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 4.7.1 to 4.7.3. The HMAC identity signature that the AI Chat embed prints for logged-in users is computed over the bare email address with the same lookup secret that authenticates the plugin's customer-data REST endpoint (/wp-json/yamidoo/v1/customer), whose requests are signed over '<timestamp>.<email>', with no domain separation. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their account email to a crafted address such as '<timestamp>[email protected]' (for example through the WooCommerce My Account page, which applies email changes without confirmation), read the signature from the page, and replay it to that endpoint to retrieve another customer's orders, license keys and subscriptions from Easy Digital Downloads or WooCommerce. Exploitation requires the AI Chat to be connected through this plugin with logged-in user identification and customer data sharing enabled, both of which are on by default once connected.
References
- https://wpsec.com/vuln/WPSEC-2026-0261/
- https://plugins.svn.wordpress.org/social-icons-widget-by-wpzoom/tags/4.7.4/
- https://wordpress.org/plugins/social-icons-widget-by-wpzoom/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS