Remote Code Execution Vulnerability in Social Warfare Plugin for WordPress
CVE-2021-4434

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
Social Sharing Plugin – Social Warfare
Vendor
CVE Published:
17 January 2024

What is CVE-2021-4434?

The Social Warfare plugin for WordPress presents a significant security issue due to a vulnerability that enables Remote Code Execution. This flaw, affecting versions up to 3.5.2, arises from improper handling of the 'swp_url' parameter, allowing attackers to inject and execute malicious code on the server hosting the affected website. Exploitation of this vulnerability could lead to complete compromise of the targeted WordPress installation, making it critical for site owners to update to the latest version or apply necessary patches to mitigate potential risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Social Sharing Plugin – Social Warfare * < 3.5.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://packetstormsecurity.com/files/163680/WordPress-So...

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raed Ahsan
JSON
.