CVE-2021-24312 WP Super Cache < 1.7.3 - Authenticated Remote Code Execution
Authenticated attackers can execute arbitrary code via unsanitized settings parameters in the WP Super Cache WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24312?
CVE-2021-24312 is a high-severity code injection vulnerability in Automattic WP Super Cache, published on 1 Jun 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
Which versions are affected by CVE-2021-24312?
It affects 1 product.
Products include Automattic Wp Super Cache.
How do I fix CVE-2021-24312?
No fix has been published for CVE-2021-24312 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-24312 being exploited?
There is no known exploitation of CVE-2021-24312 in the wild and no public exploit code.
Other vulnerabilities in Automattic WP Super Cache
- CVE-2013-2010 Code injection in W3 Total Cache Plugin
- CVE-2013-2009 Code injection in WP Super Cache Plugin
- CVE-2021-24209 WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)
- CVE-2013-2008 Cross-site scripting in Super Cache Plugin
- CVE-2021-24329 WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)
Sources
Also known as GHSA-5r22-g25f-j577.