CVE-2024-1685 is a high-severity vulnerability (CVSS 8.8) affecting the Social Media Share Buttons WordPress plugin (up to version 2.1.0). It arises from unsafe deserialization of untrusted data via the attachmentUrl parameter, enabling PHP Object Injection by authenticated users with subscriber-level privileges or higher. The plugin lacks an internal POP chain, but if combined with other installed components that provide one, attackers could achieve critical impacts such as arbitrary file deletion, sensitive data retrieval, or remote code execution. CVE-2024-2721 appears to be a duplicate of this issue. No official patch or remediation guidance is currently documented.

Successful exploitation requires authenticated access at subscriber level or above. Without a POP chain in the plugin itself, direct exploitation is limited; however, if other plugins or themes on the target system provide a POP chain, attackers could perform destructive or unauthorized actions including file deletion, data exposure, or code execution. This elevates the risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the vendor or WordPress security channels regarding patches or mitigations.