Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
WordPress caching plugins PHP code execution - Vulnerability Database

WordPress caching plugins PHP code execution

Description

Two very popular WordPress caching plugins (WP Super Cache and W3 Total Cache) are vulnerable to PHP code execution via interpretation of dynamic snippets, that are contained inside a number of specific HTML-comment tags. WP Super Cache (before version 1.3) and W3 Total Cache (before version 0.9.2.9) are vulnerable to this issue.

Remediation

Upgrade the vulnerable plugin(s) to the latest version.

References

WP Caching plugin vulnerability debrief
WP Super Cache
W3 Total Cache
Initial report of the vulnerability

Related Vulnerabilities

MongoDB $where operator JavaScript injection High
Common tags: Code Execution Known Vulnerabilities
Apache Struts2 Remote Command Execution (S2-052) High
Common tags: Code Execution Known Vulnerabilities
SAP Hybris Deserialization RCE High
Common tags: Code Execution Known Vulnerabilities
Kramer VIAware RCE (CVE-2021-36356/CVE-2021-35064) Critical
Common tags: Code Execution Known Vulnerabilities
VMware Aria Operations for Networks RCE (CVE-2023-20887) Critical
Common tags: Code Execution Known Vulnerabilities

Severity

High

Classification

CVE-2013-2010
CWE-95
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Code Execution
Known Vulnerabilities