CVE-2019-9978

What is Social Warfare?

Social Warfare is a WordPress plugin that adds social-media sharing buttons and share-count displays to posts and pages, used on a large number of WordPress sites for content marketing and engagement.

Overview

CVE-2019-9978 is a cross-site scripting (XSS) vulnerability (CWE-79) in the Social Warfare and Social Warfare Pro plugins, affecting versions up to 3.5.2. It became notorious in security circles because it was mass-exploited in the wild within roughly a day of being publicly disclosed in March 2019 — one of the fastest real-world exploitation turnarounds of a WordPress plugin flaw at that time.

Technical Details

The vulnerability stems from insufficient sanitization of the swp_url parameter used by the plugin's social-sharing functionality. By submitting a specially crafted swp_url value, an attacker could inject malicious JavaScript that executes in the context of visitors' or administrators' browsers; in the real-world attacks, this was leveraged to redirect site visitors to attacker-controlled domains and inject further malicious scripts into compromised pages.

Discovery

Wordfence's Threat Intelligence team publicly documented this vulnerability and its mass exploitation in March 2019, after observing large numbers of compromised WordPress sites serving malicious pop-up redirects shortly after the plugin flaw became public.

Exploitation Context

Within about a day of disclosure, attackers were mass-scanning for and exploiting vulnerable Social Warfare installations, injecting scripts that redirected site visitors to scam and malware-delivery pages across thousands of WordPress sites. CISA added this CVE to the KEV catalog in November 2021, reflecting this well-documented history of rapid, widespread exploitation.

Remediation

1. Update Social Warfare (and Social Warfare Pro) to version 3.5.3 or later immediately.
2. If running an affected version, check site content and database for injected redirect scripts or unfamiliar JavaScript.
3. Review WordPress admin accounts and file integrity for signs of follow-on compromise.
4. Use a WordPress security plugin or web application firewall to catch known exploitation patterns for this and similar plugin vulnerabilities.
5. Regularly audit installed plugins for updates and remove any that are no longer maintained.