Remote Code Execution Vulnerability in Social Warfare Plugin for WordPress
CVE-2021-4434

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
Social Sharing Plugin – Social Warfare
Vendor
CVE Published:
17 January 2024

What is CVE-2021-4434?

The Social Warfare plugin for WordPress presents a significant security issue due to a vulnerability that enables Remote Code Execution. This flaw, affecting versions up to 3.5.2, arises from improper handling of the 'swp_url' parameter, allowing attackers to inject and execute malicious code on the server hosting the affected website. Exploitation of this vulnerability could lead to complete compromise of the targeted WordPress installation, making it critical for site owners to update to the latest version or apply necessary patches to mitigate potential risks.

Affected Version(s)

Social Sharing Plugin – Social Warfare * < 3.5.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://packetstormsecurity.com/files/163680/WordPress-So...

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raed Ahsan
.