CVE-2024-3228: Kiwi Social Share Information Disclosure Flaw

CVE-2024-3228 Overview

CVE-2024-3228 affects the Social Sharing Plugin Kiwi for WordPress, developed by wpkube. All versions up to and including 2.1.7 contain an information exposure flaw in the kiwi-nw-pinterest class. Unauthenticated attackers can view limited content from password-protected posts by leveraging the vulnerable class. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is exploitable remotely without authentication or user interaction, though it does not allow modification or destruction of data.

Critical Impact
Unauthenticated remote attackers can extract limited content from password-protected WordPress posts, bypassing the plugin's expected access control on protected content.

Affected Products

Wpkube Kiwi Social Share plugin for WordPress, versions up to and including 2.1.7
WordPress sites using the kiwi-nw-pinterest class functionality
Any WordPress deployment relying on the Kiwi Social Sharing Plugin for content on password-protected posts

Discovery Timeline

2024-07-09 - CVE-2024-3228 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3228

Vulnerability Analysis

The vulnerability resides in the kiwi-nw-pinterest class inside the Kiwi Social Share plugin. The class exposes content from posts without verifying whether the parent post is password-protected. WordPress normally restricts access to post content until the visitor supplies the correct password. The plugin bypasses this control by rendering or returning post data through its own code path.

Unauthenticated attackers can query the affected functionality directly and receive limited content from posts that should remain protected. The information exposure is limited in scope, affecting confidentiality only. Integrity and availability of the WordPress site are not impacted.

Root Cause

The root cause is a missing authorization check ([CWE-200]) in the kiwi-nw-pinterest class. The plugin does not verify the post-protection status before returning content used for social sharing functionality. WordPress core functions such as post_password_required() are not consulted before content is rendered by the plugin.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker enumerates WordPress posts on a target site, then triggers the vulnerable kiwi-nw-pinterest class functionality. The response contains limited data derived from posts that are configured as password-protected. No exploit code has been published to public exploit databases, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability manifests in the kiwi-nw-pinterest class handling of post content. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-3228

Indicators of Compromise

Unauthenticated HTTP requests targeting endpoints or resources associated with the kiwi-nw-pinterest class
Web server access logs showing repeated enumeration of WordPress post IDs from a single client
Outbound social sharing calls or previews referencing content from posts marked as password-protected

Detection Strategies

Inventory WordPress installations and identify sites running the Kiwi Social Share plugin at version 2.1.7 or earlier
Review web server logs for requests referencing Kiwi plugin assets or endpoints correlated with password-protected post IDs
Use a web application firewall to alert on anomalous access patterns targeting the plugin's Pinterest sharing functionality

Monitoring Recommendations

Enable verbose access logging on the WordPress front end and archive logs for retrospective analysis
Monitor plugin version inventory and alert when hosts fall behind the fixed release
Track HTTP responses that return post content to unauthenticated clients for password-protected URLs

How to Mitigate CVE-2024-3228

Immediate Actions Required

Update the Kiwi Social Share plugin to a version newer than 2.1.7 that contains the fix referenced in the WordPress Plugin Changeset
Audit password-protected posts for sensitive content that may have been exposed prior to patching
Restrict access to the WordPress admin and plugin update mechanisms to authorized administrators

Patch Information

The vendor addressed the issue in the changeset published on the WordPress plugin repository. Site owners should upgrade to the latest available version of the Kiwi Social Share plugin. Reference the WordPress Plugin Changeset and the Wordfence Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the Kiwi Social Share plugin until the patched version can be deployed
Avoid using password-protected posts as the sole control for sensitive information while the plugin is active
Deploy web application firewall rules that block unauthenticated requests targeting the kiwi-nw-pinterest class endpoints

bash

# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate kiwi-social-share
wp plugin delete kiwi-social-share

# After patch is available, reinstall and update
wp plugin install kiwi-social-share --activate
wp plugin update kiwi-social-share