CVE-2019-6726

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Fastest Cache
Vendor
CVE Published:
29 July 2019

Summary

The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header.

References

https://wordpress.org/plugins/wp-fastest-cache/#developers
x_refsource_MISC
https://wordpress.org/plugins/wp-fastest-cache/
x_refsource_MISC
https://www.wpfastestcache.com/
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.