Description (CNA)
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / WP Super Cache | affected 0 before 1.7.2 |
CWE
No CWE identifiers supplied.
References
- https://wpscan.com/vulnerability/733d8a02-0d44-4b78-bbb2-37e447acd2f3
- https://plugins.trac.wordpress.org/changeset/2496238/wp-super-cache
ADP enrichment
No English description supplied.