WP Fastest Cache <= 0.8.9.0 - Unauthenticated Arbitrary File Deletion



Description
According to the original researcher:

"Although a successful exploit leads to data loss and potentially a DoS against the website, because wordpress won't find important files to run, there are several requirements which need to be met:

- WP Fastest Cache is installed and the cache is activated
- Wordpress is configured to use 'pretty' URL schemes, like /<data>/<title> etc.
- WP Postratings [1] is installed
- At least one ratable post or page was published"

Affects Plugin

fixed in version 0.8.9.1

References

CVE 2019-6726
PACKETSTORM 152042
URL https://0day.work/cve-2019-6726-arbitrary-file-deletion-in-wp-fastest-cache-0-8-8-1/
URL https://seclists.org/fulldisclosure/2019/Mar/17

Classification

Type UNKNOWN

Miscellaneous

Original Researcher Sebastian Neef
Submitter Ryan Dewhurst
Submitter Website https://dewhurstsecurity.com/
Submitter Twitter ethicalhack3r
Views 6129
Verified No
WPVDB ID 9226

Timeline

Publicly Published 2019-03-10 (9 months ago)
Added 2019-03-10 (9 months ago)
Last Updated 2019-11-27 (16 days ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin