The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber
References
| Link | Resource |
|---|---|
| https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ | Third Party Advisory |
| https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ - Exploit, Third Party Advisory | |
| References | () https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ - Third Party Advisory |
19 Jan 2024, 15:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ - Third Party Advisory | |
| References | () https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ - Exploit, Third Party Advisory | |
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Wpfastestcache
Wpfastestcache wp Fastest Cache |
|
| CPE | cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:* |
16 Jan 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-16 16:15
Updated : 2024-11-21 05:53
NVD link : CVE-2021-24869
Mitre link : CVE-2021-24869
CVE.ORG link : CVE-2021-24869
JSON object : View
Products Affected
wpfastestcache
- wp_fastest_cache
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')