CVE-2021-24869

moderate-risk
Published 2024-01-16

The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber

Do I need to act?

-
0.60% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Wpfastestcache

References (4)

Exploit https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plug...
Third Party Advisory https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/
Exploit https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plug...
Third Party Advisory https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/
37
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal