Exploits in the Wild for Word Press Social Warfare Plugin CVE-2019-9978
Summary: Researchers disclosed two vulnerabilities in the Social Warfare WordPress plugin, a stored XSS and a remote code execution flaw tracked as CVE-2019-9978, present in versions 3.5.0 through 3.5.2 and fixed in 3.5.3 on 21 March. Unit 42 found five compromised sites hosting malicious exploit code and roughly 40,000 sites with the plugin installed, most running a vulnerable version, with about 60,000 active installations potentially exposed.
Key Takeaway: An unauthenticated attacker can run arbitrary PHP code and take control of the website and server, and the affected sites include education, finance, and news properties that draw high traffic, so their visitors can be exposed to malware, phishing pages, or miners.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-9978
- Related
- CVE-2019-9978: Word Press Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026