CVE-2021-4434 Social Warfare <= 3.5.2 - Remote Code Execution

Q: What is CVE-2021-4434?

CVE-2021-4434 is a critical code injection vulnerability in warfareplugins Social Sharing Plugin – Social Warfare, published on 17 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2021-4434 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-4434 exists.

Q: How do I fix CVE-2021-4434?

No fix has been published for CVE-2021-4434 yet. Limit exposure of the affected software until one is available.

Critical 10.0 Published 17 Jan 2024 Updated 8 Apr 2026

Attackers can execute arbitrary code on the server via the swp_url parameter in the Social Warfare WordPress plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-4434?

CVE-2021-4434 is a critical code injection vulnerability in warfareplugins Social Sharing Plugin – Social Warfare, published on 17 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.

Weakness: CWE-94

Which versions are affected by CVE-2021-4434?

It affects 1 product.

Products include Warfareplugins Social Warfare.

How do I fix CVE-2021-4434?

No fix has been published for CVE-2021-4434 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-4434 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-4434 exists.

Sources

Also known as GHSA-6gjp-6pv7-w558.