The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.
References
| Link | Resource |
|---|---|
| https://plugins.trac.wordpress.org/changeset/2235160/wp-fastest-cache | Patch |
| https://wearetradecraft.com/advisories/tc-2020-0001/ | Third Party Advisory Exploit |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/82f80916-37ab-4c5a-9787-2544c620acac?source=cve | Third Party Advisory |
Configurations
History
13 Mar 2025, 13:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/changeset/2235160/wp-fastest-cache - Patch | |
| References | () https://wearetradecraft.com/advisories/tc-2020-0001/ - Third Party Advisory, Exploit | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/82f80916-37ab-4c5a-9787-2544c620acac?source=cve - Third Party Advisory | |
| CPE | cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:* | |
| First Time |
Wpfastestcache wp Fastest Cache
Wpfastestcache |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CWE | CWE-22 |
16 Oct 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-16 07:15
Updated : 2025-03-13 13:30
NVD link : CVE-2020-36836
Mitre link : CVE-2020-36836
JSON object : View
Products Affected
wpfastestcache
- wp_fastest_cache
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')