Vulnerability · Published Jun 1, 2021 · Assigned by WPScan
CVE-2021-24312WP Super Cache < 1.7.3 - Authenticated Remote Code Execution
High 7.2
In plain English
A high-severity code injection in WP Super Cache from Automattic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)1.9%top 19.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Automattic | WP Super Cache | 1.7.3 – before 1.7.3 |
Weakness: CWE-94
References
- https://wpscan.com/vulnerability/2142c3d3-9a7f-4e3c-8776-d469a355d62f x_refsource_CONFIRM