CVE-2021-24312

🗓️ 01 Jun 2021 11:33:30Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 97 Views🌐 WEB

Vulnerability in WP Super Cache WordPress plugin before 1.7.3 allows RCE via input of '$' and '\n'

Reporter	Title	Published	Views	Family All 9
CNNVD	WordPress plugin WP Super Cache 操作系统命令注入漏洞	1 Jun 202100:00	–	cnnvd
Cvelist	CVE-2021-24312 WP Super Cache < 1.7.3 - Authenticated Remote Code Execution	1 Jun 202111:33	–	cvelist
EUVD	EUVD-2021-11226	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24312	1 Jun 202114:15	–	nvd
OpenVAS	WordPress WP Super Cache Plugin < 1.7.3 Multiple Vulnerabilities	22 Jun 202100:00	–	openvas
Prion	Design/Logic Flaw	1 Jun 202114:15	–	prion
RedhatCVE	CVE-2021-24312	22 May 202521:04	–	redhatcve
wpexploit	WP Super Cache < 1.7.3 - Authenticated Remote Code Execution	14 May 202100:00	–	wpexploit
WPVulnDB	WP Super Cache < 1.7.3 - Authenticated Remote Code Execution	14 May 202100:00	–	wpvulndb

NVD

Vulners

Node

automattic wp_super_cacheRange<1.7.3wordpress

[
  {
    "product": "WP Super Cache",
    "vendor": "Automattic",
    "versions": [
      {
        "lessThan": "1.7.3",
        "status": "affected",
        "version": "1.7.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/2142c3d3-9a7f-4e3c-8776-d469a355d62f

Parameter	Position	Path	Description	CWE
wp_cache_location	request body	/wordpress/wp-admin/options-general.php?page=wpsupercache&tab=settings	RCE via WP Super Cache settings by injecting newline and special variables in wp_cache_location (CVE-2021-24312).	CWE-78, CWE-94
wp_cache_debug_ip	request body	/WordPress/wp-admin/options-general.php?page=wpsupercache&tab=debug	RCE via WP Super Cache debug settings by injecting shell commands in wp_cache_debug_ip / wp_super_cache_front_page_text (CVE-2021-24312).	CWE-78, CWE-94
wp_super_cache_front_page_text	request body	/WordPress/wp-admin/options-general.php?page=wpsupercache&tab=debug	RCE via WP Super Cache debug settings by injecting shell commands in wp_cache_debug_ip / wp_super_cache_front_page_text (CVE-2021-24312).	CWE-78, CWE-94
cache_scheduled_time	request body	/wordpress/wp-admin/options-general.php?page=wpsupercache&tab=settings	RCE via expirytime settings by injecting commands in cache_scheduled_time / new_direct_page (CVE-2021-24312).	CWE-78, CWE-94
new_direct_page	request body	/wordpress/wp-admin/options-general.php?page=wpsupercache&tab=settings	RCE via expirytime settings by injecting commands in cache_scheduled_time / new_direct_page (CVE-2021-24312).	CWE-78, CWE-94

17 Jun 2026 03:39Current

6.8Medium risk

Vulners AI Score6.8

CVSS 26.5

CVSS 3.17.2

EPSS0.0171

cve-2021-24312 wp super cache rce security vulnerability wordpress plugin