CVE-2021-24209 WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)
Authenticated administrators can inject malicious code into cache configuration files, leading to remote code execution on the WordPress site.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24209?
CVE-2021-24209 is a high-severity code injection vulnerability in Unknown WP Super Cache, published on 5 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.
Weakness: CWE-94
Which versions are affected by CVE-2021-24209?
It affects 1 product.
Products include Automattic Wp Super Cache.
How do I fix CVE-2021-24209?
No fix has been published for CVE-2021-24209 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-24209 being exploited?
There is no known exploitation of CVE-2021-24209 in the wild and no public exploit code.
Other vulnerabilities in Unknown WP Super Cache
- CVE-2013-2010 Code injection in W3 Total Cache Plugin
- CVE-2013-2009 Code injection in WP Super Cache Plugin
- CVE-2021-24312 WP Super Cache < 1.7.3 - Authenticated Remote Code Execution
- CVE-2013-2008 Cross-site scripting in Super Cache Plugin
- CVE-2021-24329 WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)
Sources
Also known as GHSA-x99c-f7pr-mjvv.