Better Sharing <= 2.9.0 - Missing Authorization to Unauthenticated Arbitrary Email Sending via Test Email REST Route

ID

WPSEC-2026-0408

Plugin

Better Sharing (better-sharing)

Affected

from 2.2.0 before 2.10.0

Remediation

Update to 2.10.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-862

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22

Attack surface

Better Sharing on WPSec AttackSurface

Fix released

2026-10-02

Published

2026-10-03

Description

The Better Sharing plugin for WordPress is vulnerable to unauthorized email sending via the /bswp_test_email REST route in versions 2.2.0 up to, and including, 2.9.0 due to the route being registered with a permission_callback of '__return_true', protected at most by a REST nonce that is given to every visitor of a page showing the sharing widget. This makes it possible for unauthenticated attackers to make the site send emails with an arbitrary HTML body to arbitrary addresses, abusing the site as a spam or phishing relay.

References

• https://wpsec.com/vuln/WPSEC-2026-0408/
• https://plugins.svn.wordpress.org/better-sharing/tags/2.10.0/
• https://wordpress.org/plugins/better-sharing/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS