Better Sharing <= 2.9.0 - Unauthenticated Content Injection via Share Email REST Route
- ID
- WPSEC-2026-0409
- Plugin
- Better Sharing (better-sharing)
- Affected
- all versions before 2.10.0
- Remediation
- Update to 2.10.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Better Sharing on WPSec AttackSurface
- Fix released
- Published
Description
The Better Sharing plugin for WordPress is vulnerable to Content Injection via the share email REST route (bswp/v1/bswp_email) in all versions up to, and including, 2.9.0. The route is open to unauthenticated visitors by design, but it accepted any off-site URL as the shared link, inserted custom template variables into the HTML email without URL validation, applied the spam check only to the custom message (with a weak default pattern that can be switched off), and had no rate limit. This makes it possible for unauthenticated attackers to make the site send emails from its own address to arbitrary recipients containing attacker-chosen text and off-site links, for example for phishing.
References
- https://wpsec.com/vuln/WPSEC-2026-0409/
- https://plugins.svn.wordpress.org/better-sharing/tags/2.10.0/
- https://wordpress.org/plugins/better-sharing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS