CVE-2023-1938

WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF

High · published May 30, 2023

CVSS v3.1
8.8
EPSS
8%
Percentile
95.0
In the wild
Unconfirmed
What it is

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.08466 · 95.0th percentile
Published
2023-05-30T07:49Z
EPSS history
Timeline
  • 30 MAY 07:49Z
    WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF
    cvelistv5