PT-2024-10846 · WordPress · Wp Fastest Cache

Glyn Wintle · Published 2024-10-15 · Updated 2025-09-18 · CVE-2020-36836

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Fastest Cache versions up to 0.9.0.2

Description The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.

Recommendations For versions up to 0.9.0.2, update to the latest version to mitigate the risk of arbitrary file deletion. As a temporary workaround, consider restricting access to sensitive files and directories on the server until the update is applied.

Exploit

Fix

Path traversal

CSRF

Weakness Enumeration

CWE-22

CWE-352

Related Identifiers

CVE-2020-36836

Affected Products

Wp Fastest Cache

References · 12

• 🔥 https://wearetradecraft.com/advisories/tc-2020-0001 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36836 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36836 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2235160/wp-fastest-cache · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/82f80916-37ab-4c5a-9787-2544c620acac?source=cve · Note
• https://twitter.com/pdnuclei/status/1963784206355513554 · Twitter Post
• https://twitter.com/cracbot/status/1848242882303697046 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1968631119898919284 · Twitter Post
• https://twitter.com/transilienceai/status/1847688220839915882 · Twitter Post
• https://twitter.com/transilienceai/status/1847688215290863765 · Twitter Post
• https://twitter.com/CVEnew/status/1846444824037085440 · Twitter Post
• https://twitter.com/CveFindCom/status/1846446963945767248 · Twitter Post