Description

WordPress Plugin WP Super Cache is prone to a cache poisoning vulnerability. Exploiting this issue may allow a remote attacker to place invalid entries into a cache, which are then assumed to be valid when later used. WordPress Plugin WP Super Cache version 1.8 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.9 or latest

References

https://sploitus.com/exploit?id=WPEX-ID:F9DDDB51-60FF-4FED-8C89-749D92C4AF94

https://github.com/Automattic/jetpack/blob/trunk/projects/plugins/super-cache/CHANGELOG.md#changelog

Related Vulnerabilities

WordPress Plugin Theme Tuner 'tt-abspath' Parameter Remote File Include (0.7)

WordPress Plugin NotificationX-WooCommerce Sales Notification Popup, Custom & Live Sales Notification, FOMO, Social Proof, Announcement Banner & Sticky Notification Bar SQL Injection (2.3.8)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-2365)

ownCloud Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-2050)

WordPress Plugin Multiplayer Games Cross-Site Scripting (3.7)

Severity

High

Classification

CWE-349 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update