VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

Several WordPress.org Plugins <= Various Versions — Injected Backdoor

CVE-2024-6297Published · Updated

Action summary

Social Sharing Plugin – Social Warfare: Affected: 4.4.6.4 – 4.4.7.1Update to 4.4.7.3 or newer

PowerPress Podcasting plugin by Blubrry: Affected: 11.9.3 – 11.9.4Update to 11.9.6 or newer

WPCOM Member: Affected: ≤1.3.16Update to 1.3.14 or newer

Pods – Custom Content Types and Fields: Affected: 3.2.3 – 3.2.3Update to 3.2.4 or newer

Ad Invalid Click Protector (AICP): Affected: 1.2.9 – 1.2.9Update to 1.2.11 or newer

SEO Optimized Images: Affected: 2.1.2 – 2.1.2Update to 2.1.4 or newer

Twenty20 Image Before-After: Affected: ≤1.6.3Update to 1.6.4 or newer

Contact Form Multi-Step Addon: Affected: 1.0.4 – 1.0.5Update to 1.0.7 or newer

Simply Show Hooks: Affected: 1.2.1 – 1.2.2Update to 1.2.1 or newer

Britetechs Companion: Affected: 2.2.7 – 2.2.7Update to 2.2.8 or newer

Wrapper Link Elementor: Affected: 1.0.2 – 1.0.3Update to 1.0.5 or newer

BLAZE Retail Widget: Affected: 2.2.5 – 2.5.2Update to 2.5.4 or newer

WP Server Health Stats: Affected: 1.7.6 – 1.7.6Update to 1.7.8 or newer

All remediation steps
Watch plugin
Severity
Critical10.0
CVSS
10.0
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:N Privileges required
None
UI:N User interaction
None
S:C Scope
Changed
C:H Confidentiality
High
I:H Integrity
High
A:H Availability
High
Weakness
CWE-506 Embedded Malicious Code
Required access
No account needed
Exploit prediction (EPSS)
No score
CISA KEV
Not listed
On this page8

Am I affected?

Social Sharing Plugin – Social Warfare social-warfare

  1. Affected4.4.6.4 – 4.4.7.1
  2. Patched in4.4.7.3

Update to 4.4.7.3 or newer.

You are affected if you run 4.4.6.4 – 4.4.7.1. Version 4.4.7.3 and later are not affected by this issue.

PowerPress Podcasting plugin by Blubrry powerpress

  1. Affected11.9.3 – 11.9.4
  2. Patched in11.9.6

Update to 11.9.6 or newer.

You are affected if you run 11.9.3 – 11.9.4. Version 11.9.6 and later are not affected by this issue.

WPCOM Member wpcom-member

  1. Affected≤ 1.3.16
  2. Patched in1.3.14

Update to 1.3.14 or newer.

You are affected if you run ≤ 1.3.16. Version 1.3.14 and later are not affected by this issue.

Pods – Custom Content Types and Fields pods

  1. Affected3.2.3 – 3.2.3
  2. Patched in3.2.4

Update to 3.2.4 or newer.

You are affected if you run 3.2.3 – 3.2.3. Version 3.2.4 and later are not affected by this issue.

Ad Invalid Click Protector (AICP) ad-invalid-click-protector

  1. Affected1.2.9 – 1.2.9
  2. Patched in1.2.11

Update to 1.2.11 or newer.

You are affected if you run 1.2.9 – 1.2.9. Version 1.2.11 and later are not affected by this issue.

SEO Optimized Images seo-optimized-images

  1. Affected2.1.2 – 2.1.2
  2. Patched in2.1.4

Update to 2.1.4 or newer.

You are affected if you run 2.1.2 – 2.1.2. Version 2.1.4 and later are not affected by this issue.

Twenty20 Image Before-After twenty20

  1. Affected≤ 1.6.3
  2. Patched in1.6.4

Update to 1.6.4 or newer.

You are affected if you run ≤ 1.6.3. Version 1.6.4 and later are not affected by this issue.

Contact Form Multi-Step Addon contact-form-7-multi-step-addon

  1. Affected1.0.4 – 1.0.5
  2. Patched in1.0.7

Update to 1.0.7 or newer.

You are affected if you run 1.0.4 – 1.0.5. Version 1.0.7 and later are not affected by this issue.

Simply Show Hooks simply-show-hooks

  1. Affected1.2.1 – 1.2.2
  2. Patched in1.2.1

Update to 1.2.1 or newer.

You are affected if you run 1.2.1 – 1.2.2. Version 1.2.1 and later are not affected by this issue.

Britetechs Companion britetechs-companion

  1. Affected2.2.7 – 2.2.7
  2. Patched in2.2.8

Update to 2.2.8 or newer.

You are affected if you run 2.2.7 – 2.2.7. Version 2.2.8 and later are not affected by this issue.

Wrapper Link Elementor wrapper-link-elementor

  1. Affected1.0.2 – 1.0.3
  2. Patched in1.0.5

Update to 1.0.5 or newer.

You are affected if you run 1.0.2 – 1.0.3. Version 1.0.5 and later are not affected by this issue.

BLAZE Retail Widget blaze-widget

  1. Affected2.2.5 – 2.5.2
  2. Patched in2.5.4

Update to 2.5.4 or newer.

You are affected if you run 2.2.5 – 2.5.2. Version 2.5.4 and later are not affected by this issue.

WP Server Health Stats wp-server-stats

  1. Affected1.7.6 – 1.7.6
  2. Patched in1.7.8

Update to 1.7.8 or newer.

You are affected if you run 1.7.6 – 1.7.6. Version 1.7.8 and later are not affected by this issue.

  • Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Social Sharing Plugin – Social Warfare.
  • No admin access? Run a passive check of your site. It reads public files only.
  • No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

  1. Update to version 4.4.7.3, or a newer patched version
  2. Update to version 11.9.6, or a newer patched version
  3. Update to version 1.3.14, or a newer patched version
  4. Update to version 3.2.4, or a newer patched version
  5. Update to version 1.2.11, or a newer patched version
  6. Update to version 2.1.4, or a newer patched version
  7. Update to version 1.6.4, or a newer patched version
  8. Update to version 1.0.7, or a newer patched version
  9. Update to version 1.2.1, or a newer patched version
  10. Update to version 2.2.8, or a newer patched version
  11. Update to version 1.0.5, or a newer patched version
  12. Update to version 2.5.4, or a newer patched version
  13. Update to version 1.7.8, or a newer patched version
  14. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
  15. Watch Social Sharing Plugin – Social Warfare to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence.

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. All plugins have received updates reverting any added malicious code. Simply Show Hooks affected version (1.2.1) is the same as the patched version (1.2.1) - it does not appear that the malicious copy was ever officially released, so sites running 1.2.1 should be unaffected, though it is a good idea to run a complete Wordfence scan and verify that there are no rogue administrator accounts present.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

More in Social Sharing Plugin – Social Warfare

All 9
More vulnerabilities in Social Sharing Plugin – Social Warfare
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.5.5Update to 4.5.6
CVE-2025-26973
Medium4.3Cross-Site Request Forgery
≤4.4.5.1Update to 4.4.6
CVE-2024-34825
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.4.6.1Update to 4.4.6.2
CVE-2024-1959
Medium6.4Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤4.4.3Update to 4.4.4
CVE-2023-4842
Medium5.4Cross-Site Request Forgery
≤4.3.1Update to 4.4.0
CVE-2023-0403

Timeline

  1. CVE published

    Severity critical, CVSS 10.0

  2. Record last updated

Sources & licenses

Wordfence record
Vulnerability data
Wordfence Intelligence. [object Object] Licensed under the CC BY-SA 4.0.
CVE® identifiers
[object Object]. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
VulnCrest content
Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?