WordPress CVEs

Description

The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.

Affected WordPress components

• WP Fastest Cache – WordPress Cache Plugin Plugin · wp-fastest-cache
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wpfastestcache wp_fastest_cache — Up to and including 0.8.9.0

References

• packetstormsecurity.com https://packetstormsecurity.com/files/152042 Exploit, Third Party Advisory, VDB Entry
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-fastest-cache/trunk/wpFastestCache.php Third Party Advisory
• wordpress.org https://wordpress.org/plugins/wp-fastest-cache/ Product
• wordpress.org https://wordpress.org/plugins/wp-fastest-cache/#developers Release Notes
• www.wpfastestcache.com https://www.wpfastestcache.com/ Product
• nvd.nist.gov Official NVD record