CVE-2024-2721: High PHP Object Injection in Share Buttons Plugin

CVE-2024-2721 is a deserialization of untrusted data flaw in the Social Media Share Buttons WordPress plugin by Sygnoos through version 2.1.0, rated High at 8.2. Severity is High at 8.2. Check the plugin's page for a release newer than 2.1.0, because the sources I fetched do not name a fixed version.

What's affected

• Social Media Share Buttons by Sygnoos versions up to and including 2.1.0.
• Patchstack classifies it as PHP object injection and lists vulnerable versions as 2.1.0 or earlier.
• The Patchstack page I fetched does not name a patched version, and says a mitigation rule exists until an official patch is available.

The NVD record gives a CVSS score of 8.2 with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. Published 2024-03-20.

How to check if you're exposed

1. Run wp plugin list --fields=name,version,status and look for social-media-builder.
2. Or open Plugins in the WordPress admin and read the version.
3. Check the plugin directory page for a newer release.

What to do now

1. If a release newer than 2.1.0 exists, update to it.
2. If none exists, deactivate and remove the plugin and use a maintained alternative.
3. If you cannot remove it right away, restrict access with your web application firewall.
4. Review the site for unexpected files, users or settings.

If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.

Why it matters

Deserialization of untrusted data means the application rebuilds objects from input that an outsider can influence. In PHP, this can let an attacker choose which classes get created, and the effects depend on other code in the site, such as other plugins. The vector shows high confidentiality and integrity impact with a changed scope. High attack complexity reflects that exploitation depends on conditions beyond the plugin itself.

The record tags the weakness as CWE-502. See the Gold pages for more on the class.

The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.

Share button plugins are simple on the surface, which makes it easy to overlook them in audits.

On a WordPress site, plugins are the largest part of the attack surface that you did not write. A deserialization flaw in one plugin can combine with code in another, so the real risk depends on the whole plugin set. Reducing the number of active plugins reduces that risk in a way that no single patch can. Keep a list of what is installed and why, and remove anything without a clear owner.

Quick check

Sources

• Patchstack entry for Social Media Share Buttons 2.1.0

Last reviewed: 19 October 2026.