The Social Icons Widget & Block by WPZOOM plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the add_menu_item() method hooked to admin_menu. This method performs wp_insert_post() and update_post_meta() calls to create a sharing configuration post without verifying that the current user has administrator-level capabilities. Consequently, authenticated users with Subscriber-level access or higher can trigger the creation of a published wpzoom-sharing configuration post with default sharing button settings. This causes social sharing buttons to be automatically injected into all post content on the frontend via the the_content filter. The vulnerability affects all versions up to and including 4.5.8 and has a CVSS 3.1 base score of 4.3 (medium severity). No patch or official remediation guidance is currently available.

The vulnerability allows authenticated users with low-level privileges (Subscriber and above) to modify plugin data by creating published sharing configuration posts without proper authorization. This leads to unauthorized injection of social sharing buttons into all post content on the frontend. There is no impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting plugin access to trusted users only and monitor for unauthorized changes to sharing configuration posts. Avoid granting Subscriber-level users unnecessary access privileges.