The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber
References
| Link | Resource |
|---|---|
| https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ | Third Party Advisory |
| https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ - Exploit, Third Party Advisory | |
| References | () https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/ - Third Party Advisory |
19 Jan 2024, 15:25
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-16 16:15
Updated : 2024-11-21 05:53
NVD link : CVE-2021-24869
Mitre link : CVE-2021-24869
CVE.ORG link : CVE-2021-24869
JSON object : View
Products Affected
wpfastestcache
- wp_fastest_cache
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')