I just logged in here to see if anyone had mentioned this yet, as I’m seeing the same thing with my client’s sites that use this plugin. Hoping for an update.
I gave up and emailed support. Initially I was told to upgrade my plugin by deleting what was installed and then reinstalling from the repository. This was fruitless since it installed the same version 4.4.0.
When I pointed this out, I was then informed: “Thanks Paul – Our development team is going to reach out to them.”
And in truth, this “vulnerability” was not really a vulnerability. Basically the vulnerability allowed a hacker with “user” permissions (which is any current paid customer) to be able to log in and temporarily disconnect FB handshake on someone else’s account. But on the next cron, the handshake would fix itself. So why would a hacker waste their time trying to annoy someone with a temporarily disconnected FB.
But, this is a vulnerability and we take security very seriously. And it has been patched. We will be releasing 4.4.1 and fix a few other minor bugs. We want to always try to improve and be the best social sharing plugin on the market. Thank you
