CVE-2024-1685 is a high severity (CVSS 8.8) PHP object injection flaw in the Social Media Share Buttons plugin for WordPress, in all versions up to and including 2.1.0. Authenticated users with subscriber access and above can inject an object through the attachmentUrl parameter. Update to a newer release.
What's affected
The record says all versions through 2.1.0 are affected and that the flaw is deserialization of untrusted input through the attachmentUrl parameter. It adds that no known POP chain is present in the vulnerable plugin, so impact depends on other plugins or themes on the same site. The reference is the plugin source and a Wordfence entry. We did not fetch them, so confirm the fixed version on the plugin page.
The score is 8.8 (high) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-502 (deserialization of untrusted data).
How to check if you're exposed
List the plugin with WP-CLI.
wp plugin list --fields=name,version,status | grep -i social
The plugin directory in the record's references is social-media-builder. A version of 2.1.0 or lower is affected. Then take stock of the other plugins and themes on the site, since the record says the impact depends on whether a usable chain exists elsewhere.
What to do now
- Update the plugin to a release newer than 2.1.0.
- Review subscriber accounts and close open registration if you do not need it.
- Update all other plugins and themes, as they may supply the chain the record warns about.
- Remove plugins you do not use.
- Add a dependency check to your deployment so out of date plugins show up before attackers find them.
Why it matters
PHP object injection arises when an application feeds user controlled data into unserialize. On its own it does little. The danger comes from a property oriented chain, a set of existing classes whose methods do something harmful when rebuilt. The record says no such chain is in this plugin, but a site rarely has just one plugin.
That is why the severity is high even without a known chain: the weakness is easy to reach for any logged in user and the outcome depends on the neighborhood. Not listed as exploited. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a known chain in the plugin?
The record says no known POP chain is present in the vulnerable plugin, but a chain in another plugin or theme could make it exploitable.
Sources
Last reviewed: 19 October 2026.
