Code Injection in WP Super Cache - #VU51567

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the settings page. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Sources

• https://patchstack.com/database/vulnerability/wp-super-cache/wordpress-wp-super-cache-plugin-1-7-1-authenticated-remote-code-execution-rce-vulnerability
• https://wordpress.org/plugins/wp-super-cache/#developers