CVE-2023-1938 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF
An attacker can exploit a missing CSRF check and lack of input validation to perform blind server-side request forgery attacks against the WP Fastest Cache plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-1938?
CVE-2023-1938 is a high-severity server-side request forgery vulnerability in Unknown WP Fastest Cache, published on 30 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue
Which versions are affected by CVE-2023-1938?
It affects 1 product.
Products include Wpfastestcache Wp Fastest Cache.
How do I fix CVE-2023-1938?
No fix has been published for CVE-2023-1938 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-1938 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1938 exists.
Other vulnerabilities in Unknown WP Fastest Cache
Sources
Also known as GHSA-8wvj-4mr8-vx3q.