Social Warfare
CVE-2021-4434
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.
AnalysisAI
Remote code execution in the Social Warfare WordPress plugin (versions ≤ 3.5.2) allows unauthenticated attackers to run arbitrary code on the server via the 'swp_url' parameter. Publicly available exploit code exists and the issue carries a maximum CVSS 10.0 with scope change, while the EPSS score of 7.99% (92nd percentile) signals meaningfully elevated exploitation interest. The flaw was reported by Wordfence and primarily threatens WordPress sites still running this abandoned/legacy plugin version.
Technical ContextAI
Social Warfare is a popular social-sharing plugin for WordPress published by warfareplugins. The CPE cpe:2.3:a:warfareplugins:social_warfare confirms the affected product line and the wordpress target platform. The root cause maps to CWE-94 (Improper Control of Generation of Code, i.e., Code Injection): the plugin processes the 'swp_url' parameter in a way that allows attacker-supplied content to be interpreted and executed as code on the server, almost certainly by fetching a remote payload and evaluating it within the PHP runtime. Because WordPress plugins run with full PHP privileges of the web server, code injection inside the plugin translates directly into arbitrary command execution in the WordPress context.
RemediationAI
Upgrade the Social Warfare plugin to a version newer than 3.5.2 as published on the WordPress plugin repository; the input data does not specify an exact fix version, so Patch available per vendor advisory and administrators should verify the latest release directly from warfareplugins before deploying. If immediate upgrade is not possible, deactivate and remove the Social Warfare plugin entirely, which eliminates the vulnerable code path at the cost of losing social-sharing widgets on the site. As a temporary compensating control, use a WAF or web server rule (ModSecurity, Wordfence, Cloudflare) to block requests containing the 'swp_url' parameter to plugin endpoints, accepting that this may break legitimate plugin functionality, and restrict administrative and plugin endpoints by IP where feasible to reduce exposure until the plugin is updated or removed.
Share
External POC / Exploit Code
Leaving vuln.today