Autopost for X (formerly Autoshare for Twitter)
Autopost for X (formerly Autoshare for Twitter) has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2022 was the busiest year with 2 disclosures.
The most common weakness is Code Injection, behind 1 of the records (25%). Other recurring categories include Inefficient Regular Expression Complexity, Missing Authorization.
Every one of the 4 issues recorded for Autopost for X (formerly Autoshare for Twitter) has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Autopost for X (formerly Autoshare for Twitter) is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-25912simple-git < 3.15.0 - Remote Code Execution
Read the full analysisVulnerability Records

Autopost for X (formerly Autoshare for Twitter)
Author
10up
Autopost for X (formerly Autoshare for Twitter) automatically shares your posts to X/Twitter as soon as they’re published. Once you hit the Publish button, the plugin sends your post’s title, featured image, and link to X/Twitter, along with a custom message. Unlike a myriad of other social media, multitool solutions, Autopost for X is built solely for X/Twitter. It focuses on doing one thing and does it well, with the code and interface craftsmanship we apply to every project. With Autopost for X, developers can further customize nearly everything about the posts, including the image, author, and link, using an extensive set of hooks built into the code. Among its other features, the WordPress plugin: Works in both the classic and new block editors. Becomes part of the pre-publish checklist step that’s part of the new block editor. Posts a high-quality featured image with your post to X/Twitter. Counts characters to keep you under the X/Twitter limit. Adds a link to the post to X/Twitter in the block editor sidebar. Disclaimer: TWITTER, TWEET, RETWEET and the Twitter logo are trademarks of Twitter, Inc. or its affiliates. Paid API Access In early 2026, X effectively removed free API access for all users except public utilities. Most users will now require paid API access via the X Developer Console. Plugin Compatibility Distributor When using with 10up’s Distributor plugin, posts that are distributed will not be autoposted if they are already posted to X/Twitter from the origin site. Autopost for X tracks posts that have been posted to X/Twitter in post meta to avoid “double posting”. To avoid this behavior, use the dt_blacklisted_meta filter to exclude the ‘autoshare_for_twitter_status’ meta value from being distributed : add_filter( 'dt_blacklisted_meta', function( $blacklisted_metas ) { $blacklisted_metas[] = 'autoshare_for_twitter_status'; return $blacklisted_metas; } ) Developers Note: Posts and pages are supported by default. Developers can use the autoshare_for_twitter_default_post_types filter to change the default supported post types Custom post types can now be opted into autopost features like so: function opt_my_cpt_into_autoshare() { add_post_type_support( 'my-cpt', 'autoshare-for-twitter' ); } add_action( 'init', 'opt_my_cpt_into_autoshare' ); In addition, adding support while registering custom post types also works. Post types are automatically set to autopost. Future versions of this plugin could allow this to be set manually. While the autopost feature can be opted into for post types using the above filter, by default the editor still has to manually enable autopost during the post prepublish flow. The autoshare_for_twitter_enabled_default filter allows autopost to be enabled by default for all posts of a given post type. Editors can still manually uncheck the option during the publishing flow. Example: function enable_autoshare_by_default_for_core_post_type( $enabled, $post_type ) { if ( 'post' === $post_type ) { return true; } return $enabled; } add_filter( 'autoshare_for_twitter_enabled_default', 'enable_autoshare_by_default_for_core_post_type', 10, 2 ); Additional technical details can be found in our GitHub repository.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C