CVE-2024-6297
Several WordPress.org Plugins <= Various Versions - Injected Backdoor
- State
- Published
- Severity
- 10.0 Critical
- Published
- Jun 25, 2024
- Updated
- Aug 1, 2024
- Reserved
- Jun 25, 2024
Description
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | Wordfence |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Social Sharing Plugin – Social Warfarewarfareplugins |
|
Contact Form 7 Multi-Step Addonthemerex |
|
Simply Show Hooksstuartobrien |
|
Wrapper Link Elementorpedrogusmao02 |
|
BLAZE Retail Widgetblazeretail |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/56d24bc8-4a1a-4e60-aec5-960703a6058a?source=cve
- https://wordpress.org/support/topic/a-security-message-from-the-plugin-review-team/
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L54
- https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L583
- https://plugins.trac.wordpress.org/changeset/3105893/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106042%40social-warfare&new=3106042%40social-warfare&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/browser/simply-show-hooks/trunk/index.php
- https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-addon/trunk/trx-contact-form-7-multi-step-addon.php
- https://plugins.trac.wordpress.org/browser/wrapper-link-elementor/trunk/wrapper.php?rev=3106508
- https://plugins.trac.wordpress.org/browser/blaze-widget/trunk/blaze_widget.php
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.