Flaws in Two Popular WordPress Plugins Affect Over 7 Million Websites

Researchers have disclosed vulnerabilities in multiple WordPress plugins that, if successfully exploited, could allow an attacker to run arbitrary code and take over a website in certain scenarios. The flaws were uncovered in Elementor, a website builder plugin used on more than seven million...

WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)

The plugin was affected by an authenticated admin+ RCE in the settings page due to input validation failure and weak $cachepath check in the WP Super Cache Settings - Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for...

WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)

The plugin was affected by an authenticated admin+ RCE in the settings page due to input validation failure and weak $cachepath check in the WP Super Cache Settings - Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for...

WordPress WP Super Cache plugin <= 1.7.1 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability settings page discovered by m0ze Patchstack Red Team in WordPress WP Super Cache plugin versions = 1.7.1. Solution Update the WordPress WP Super Cache plugin to the latest available version at least 1.7.2...

CVE-2013-2009

WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution...

CVE-2013-2008

WordPress Super Cache Plugin 1.3 has XSS...

Cross site scripting

WordPress Super Cache Plugin 1.3 has XSS...

Code injection

WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution...

CVE-2013-2009

WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution...

CVE-2013-2009

The CVE-2013-2009 entry concerns WordPress WP Super Cache Plugin 1.2, which is vulnerable to remote PHP code execution via unsanitized input (e.g., malicious blog comments). Root cause cited as an incomplete fix for CVE-2013-2009. Impact is remote code execution on the web server as the web-serve...

CVE-2013-2008

The CVE-2013-2008 entry concerns WordPress Super Cache Plugin 1.3 with multiple URI-based XSS vulnerabilities in trunk/plugins/domain-mapping.php, trunk/plugins/awaitingmoderation.php, trunk/plugins/badbehaviour.php, and trunk/wp-cache.php, as reported by several sources. Root cause: XSS in plugi...

CVE-2013-2008

WordPress Super Cache Plugin 1.3 has XSS...

CVE-2013-2011

WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009...

Remote code execution

WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009...

CVE-2013-2011

CVE-2013-2011 affects the WordPress plugin W3 Super Cache (aka WP Super Cache) for versions before 1.3.2. The issue is a PHP code-execution vulnerability caused by an incomplete fix from CVE-2013-2009, allowing remote attackers to inject arbitrary code. Affected: WordPress/W3 Super Cache plugin p...

CVE-2013-2011

WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrary code. This issue exists because of an incomplete fix for CVE-2013-2009...

Automattic: Multiple File Manipulation bugs in WP Super Cache

Summary I got redirected to report the vulnerabilities here by Brandon Kraft one of your developers, so I am reporting them here. Basically, the issue is caused because of insufficient filtering there is one but it can be bypassed For instance, in /wp-cache.php, you used: 1575: $page =...

Ian Dunn: constant cache_page_secret in regolith

in: https://github.com/iandunn/regolith/blob/master/config/plugins/wp-super-cache.phpL28 $cachepagesecret = 'ad270361c39c428c9465313363b02559'; there usage of static $cachepagesecret, as regolith is installation template. it's better to generate the secret for each installation instead of using...

WordPress W3 Total Cache and W3 Super Cache PHP Code Execution (CVE-2013-2010)

A remote code execution vulnerability has been reported in WordPress W3 Total and Super Cache Plugins. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary code on the affected system...

ownCloud: owncloud.com: WP Super Cache plugin is outdated

I know it might be out of scope, but I report it to be sure https://owncloud.org/wp-content/plugins/wp-super-cache/readme.txt shows version 1.4.4 and this version is prone to XSS and PHP Object injection http://z9.io/2015/09/25/wp-super-cache-1-4-5/...