CVE-2021-24312 WP Super Cache < 1.7.3 - Authenticated Remote Code Execution

2021-06-0111:33:30

CWE-94

WPScan

www.cve.org

0.003 Low

EPSS

Percentile

69.7%

JSON

The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of ‘$’ and ‘\n’. This is due to an incomplete fix of CVE-2021-24209.

CNA Affected

[
  {
    "product": "WP Super Cache",
    "vendor": "Automattic",
    "versions": [
      {
        "lessThan": "1.7.3",
        "status": "affected",
        "version": "1.7.3",
        "versionType": "custom"
      }
    ]
  }
]