LiveActive security incident?Get immediate response
CVE Record

CVE-2021-4434: Social Warfare <= 3.5.2 - Remote Code Execution

The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2021-4434 is a critical remote code execution issue in the WordPress Social Warfare plugin, reported for versions up to 3.5.2. An unauthenticated attacker could execute code on the web server. Treat exposed WordPress sites using this plugin as urgent until version and remediation status are confirmed.

Executive priority

Prioritize immediately for any public WordPress site using Social Warfare. Remote unauthenticated code execution can lead to site takeover, malware hosting, credential theft, or business disruption.

Technical view

The vulnerability is described as code execution via the Social Warfare plugin's swp_url parameter. CVSS 3.1 is 10.0 with network attack vector, low complexity, no privileges, and no user interaction. Sources identify CWE-94. The CVE affected-product metadata is inconsistent, so validate against plugin name and version, not CPE alone.

Likely exposure

Internet-facing WordPress sites running Social Warfare plugin versions up to and including 3.5.2 are the likely exposure. Sites not using this plugin are not indicated as affected by the provided sources.

Exploitation context

A public Packet Storm reference exists for WordPress Social Warfare 3.5.2 remote code execution. The CVE is not listed as CISA KEV in the provided bundle, so active exploitation is not confirmed here.

Researcher notes

The description and Wordfence reference support RCE in Social Warfare <=3.5.2 via swp_url. The CVE JSON affected section appears inconsistent, listing version 0 and default unaffected. Use source references and local plugin evidence for triage.

Mitigation direction

  • Inventory WordPress sites for the Social Warfare plugin.
  • If present, identify the installed plugin version.
  • Upgrade, disable, or remove vulnerable versions per vendor guidance.
  • Restrict administrative access while remediation is pending.
  • Back up and review affected sites for compromise indicators.

Validation and detection

  • Confirm whether Social Warfare is installed on each WordPress site.
  • Check whether the installed version is 3.5.2 or earlier.
  • Review web logs for suspicious requests involving swp_url.
  • Check for unexpected WordPress admin users or file changes.
  • Document remediation status for each affected site.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-4434 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

10Critical
CVSS 3.1 vector shape for CVE-2021-4434Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
warfarepluginsSocial Sharing Plugin – Social Warfare0unaffected
Weakness

CWE details

CWE-94

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.