The Social Sharing Plugin – Kiwi WordPress plugin versions up to 2.1.7 contain an information exposure vulnerability (CWE-200) identified as CVE-2024-3228. This flaw allows unauthenticated attackers to access limited content from password protected posts by exploiting the 'kiwi-nw-pinterest' CSS class. The vulnerability does not require user interaction or privileges and has a CVSS 3.1 base score of 5.3, indicating a medium severity impact limited to confidentiality. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor or third parties.

An unauthenticated attacker can view limited sensitive content from password protected posts on WordPress sites using the affected plugin versions. This exposure compromises confidentiality but does not affect integrity or availability. The impact is limited to information disclosure without further system control or disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the Social Sharing Plugin – Kiwi plugin if password protected content confidentiality is critical. Monitor vendor channels for updates and apply patches promptly once available.