PT-2021-15849 · WordPress · Wp Super Cache

Nga · Published 2021-06-01 · Updated 2022-07-29 · CVE-2021-24312

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Super Cache versions prior to 1.7.3

Description The issue arises from the parameters $cache path, $wp cache debug ip, $wp super cache front page text, $cache scheduled time, $cached direct pages in the WP Super Cache WordPress plugin settings, which allow input of special characters like $ and . This leads to remote code execution (RCE) due to an incomplete fix of a previous security issue.

Recommendations For versions prior to 1.7.3, update to version 1.7.3 or later to resolve the issue. As a temporary workaround, consider restricting input for the parameters $cache path, $wp cache debug ip, $wp super cache front page text, $cache scheduled time, $cached direct pages to prevent the use of special characters like $ and .

Exploit

Fix

RCE

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

CVE-2021-24312

Affected Products

Wp Super Cache

References · 3

• 🔥 https://wpscan.com/vulnerability/2142c3d3-9a7f-4e3c-8776-d469a355d62f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24312 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24312 · Vendor Advisory