Several WordPress.org Plugins <= Various Versions - Injected Backdoor
Priority MEDIUM 51Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01011 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| warfareplugins | Social Sharing Plugin – Social Warfare | 4.4.6.4 – 4.4.7.1 | — | No fix listed | CNA |
| ThemeREX | Contact Form 7 Multi-Step Addon | 1.0.4 – 1.0.5 | — | No fix listed | CNA |
| stuartobrien | Simply Show Hooks | 1.2.1 – 1.2.2 | — | No fix listed | CNA |
| pedrogusmao02 | Wrapper Link Elementor | 1.0.2 – 1.0.3 | — | No fix listed | CNA |
| blazeretail | BLAZE Retail Widget | 2.2.5 – 2.5.2 | — | No fix listed | CNA |
- Social Sharing Plugin – Social Warfare Vendorwarfareplugins Affected 4.4.6.4 – 4.4.7.1 Fixed in — No fix listed CNA
- Contact Form 7 Multi-Step Addon VendorThemeREX Affected 1.0.4 – 1.0.5 Fixed in — No fix listed CNA
- Simply Show Hooks Vendorstuartobrien Affected 1.2.1 – 1.2.2 Fixed in — No fix listed CNA
- Wrapper Link Elementor Vendorpedrogusmao02 Affected 1.0.2 – 1.0.3 Fixed in — No fix listed CNA
- BLAZE Retail Widget Vendorblazeretail Affected 2.2.5 – 2.5.2 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:warfareplugins:social_warfare:4.4.6.4:*:*:*:*:*:*:* | 4.4.6.4 | — | warfareplugins |
- cpe:2.3:a:warfareplugins:social_warfare:4.4.6.4:*:*:*:*:*:*:* Versions 4.4.6.4 — ·warfareplugins
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6297
- 2026-10-03 Alias added: GHSA-8242-gggm-vvxx
References
Other 10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/56d24bc8-4a1a-4e60-aec5-960703a6058a?source=cve
- https://wordpress.org/support/topic/a-security-message-from-the-plugin-review-team/
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L54
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L583
- https://plugins.trac.wordpress.org/changeset/3105893/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106042%40social-warfare&new=3106042%40social-warfare&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/browser/simply-show-hooks/trunk/index.php
- https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-addon/trunk/trx-contact-form-7-multi-step-addon.php
- https://plugins.trac.wordpress.org/browser/wrapper-link-elementor/trunk/wrapper.php?rev=3106508
- https://plugins.trac.wordpress.org/browser/blaze-widget/trunk/blaze_widget.php
More warfareplugins vulnerabilities
- TI-2019-07343 The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the… KEVCVSS 3.1MEDIUM 6.1
- TI-2021-03290 Social Warfare <= 3.5.2 - Remote Code Execution CVSS 3.1CRITICAL 10.0
- TI-2024-01825 Cross-site scripting in warfareplugins Social Sharing Plugin – Social Warfare CVSS 3.1MEDIUM 6.4
- TI-2023-04458 Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
- TI-2025-19844 WordPress Social Warfare Plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2023-00383 Social Warfare <= 4.3.0 - Missing Authorization CVSS 3.1MEDIUM 5.4
Sources
- CVE-2024-6297 · CVE Program
- CVE-2024-6297 · NVD
- FIRST EPSS
- GHSA-8242-gggm-vvxx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences