blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-6297

CRITICAL 10.0 CVSS 3.1
Published
June 25, 2024
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator users and send that data back to a server. Currently, not all plugins have been patched and we strongly recommend uninstalling the plugins for the time being and running a complete malware scan.

Affected WordPress components

  • Social Sharing Plugin – Social Warfare Plugin · social-warfare
    Confirmed match Abandoned
    From 4.4.6.4 (including) to 4.4.7.1 (including)
    View on WordPress.org
  • Simply Show Hooks Plugin · simply-show-hooks
    Possible match Active
    From 1.2.1 (including) to 1.2.2 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • warfareplugins Social Sharing Plugin – Social Warfare — From 4.4.6.4 (including) to 4.4.7.1 (including)
  • themerex Contact Form 7 Multi-Step Addon — From 1.0.4 (including) to 1.0.5 (including)
  • stuartobrien Simply Show Hooks — From 1.2.1 (including) to 1.2.2 (including)
  • pedrogusmao02 Wrapper Link Elementor — From 1.0.2 (including) to 1.0.3 (including)
  • blazeretail BLAZE Retail Widget — From 2.2.5 (including) to 2.5.2 (including)
  • warfareplugins social_warfare — From 4.4.6.4 (including) to 4.4.7.1 (including)

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/blaze-widget/trunk/blaze_widget.php
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/contact-form-7-multi-step-addon/trunk/trx-contact-form-7-multi-step-addon.php
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-show-hooks/trunk/index.php
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L54
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/social-warfare/tags/4.4.6.4/trunk/social-warfare.php#L583
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wrapper-link-elementor/trunk/wrapper.php?rev=3106508
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3105893/
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3106042%40social-warfare&new=3106042%40social-warfare&sfp_email=&sfph_mail=
  • wordpress.org https://wordpress.org/support/topic/a-security-message-from-the-plugin-review-team/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/56d24bc8-4a1a-4e60-aec5-960703a6058a?source=cve
  • nvd.nist.gov Official NVD record