CVE-2021-4434

CRITICAL

Social Warfare < 3.5.3 - Remote Code Execution via swp_url Parameter

Title source: llm
STIX 2.1

Description

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.

References (2)

Core 2

Scores

CVSS v3 10.0
EPSS 0.0192
EPSS Percentile 77.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-94
Status published
Products (2)
warfareplugins/Social Sharing Plugin – Social Warfare < 3.5.3
warfareplugins/social_warfare < 3.5.3
Published Jan 17, 2024
Tracked Since Feb 18, 2026