CVE-2021-24312CWE-94

WP Super Cache < 1.7.3 - Authenticated Remote Code Execution

published June 1, 2021

CVSS
—
EPSS
2%
Percentile
80.1
In the wild
Unconfirmed
What it is

The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01950 · 80.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2021-06-01T11:33Z
EPSS history
Timeline
  • 01 JUN 11:33Z
    WP Super Cache < 1.7.3 - Authenticated Remote Code Execution
    cvelistv5