CVE-2021-39321

The Sassy Social Share plugin before version 3.3.40 contains a PHP Object Injection vulnerability in its import configuration functionality. Unauthenticated attackers with basic user privileges can exploit this flaw through the wp_ajax_heateor_sss_import_config AJAX action by sending specially crafted serialized data that gets deserialized without proper validation. The vulnerability exists because the import_config function in the admin class lacks a capability check, allowing low-level users to inject malicious objects and potentially execute arbitrary code.

Based on public CVE data (MITRE/NVD).