CVE-2021-24312

2021-06-0114:15:08

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.7%

JSON

The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of ‘$’ and ‘\n’. This is due to an incomplete fix of CVE-2021-24209.

CPENameOperatorVersion
wp-super-cacheeq1.5.9
wp-super-cacheeq1.4.6
wp-super-cacheeq1.6.0
wp-super-cacheeq1.5.8
wp-super-cacheeq1.6.8
wp-super-cacheeq1.7.0
wp-super-cacheeq1.6.9
wp-super-cacheeq1.6.3
wp-super-cacheeq1.6.2
wp-super-cacheeq1.6.1

Name	Operator	Version
wp-super-cache	eq	1.5.9
wp-super-cache	eq	1.4.6
wp-super-cache	eq	1.6.0
wp-super-cache	eq	1.5.8
wp-super-cache	eq	1.6.8
wp-super-cache	eq	1.7.0
wp-super-cache	eq	1.6.9
wp-super-cache	eq	1.6.3
wp-super-cache	eq	1.6.2
wp-super-cache	eq	1.6.1