PT-2019-7275 · WordPress · Wp Fastest Cache

Published 2019-08-14 · Updated 2019-08-19 · CVE-2015-9316

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions wp-fastest-cache plugin versions prior to 0.8.4.9

Description The issue concerns SQL injection in the wp-fastest-cache plugin for WordPress. This occurs in the "wp-admin/admin-ajax.php" endpoint, specifically when the action parameter is set to "wpfc wppolls ajax request" and the poll id parameter is manipulated.

Recommendations For versions prior to 0.8.4.9, update to version 0.8.4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php" endpoint with the "wpfc wppolls ajax request" action to minimize the risk of exploitation. Avoid using the poll id parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-9316

Affected Products

Wp Fastest Cache

References · 5

• 🔥 https://exploit-db.com/exploits/38678 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9316 · Security Note
• https://wordpress.org/plugins/wp-fastest-cache/#developers · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9316 · Note
• https://t.me/cibsecurity/6130 · Telegram Post