Author: Alex Sanford

  • Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2

    During an internal review of the WP Fastest Cache plugin, the WPScan team discovered a serious SQL injection vulnerability. This vulnerability may allow unauthenticated attackers to read the full contents of the WordPress database using a time‑based blind SQL injection payload. Upon discovering the vulnerability, we promptly alerted the plugin development team, who released version 1.2.2 More

  • Uncovering a PHAR Deserialization Vulnerability in WP Meta SEO and Escalating to RCE

    During an internal audit, the WPScan team found a vulnerability in the WP Meta SEO plugin. This vulnerability allows attackers with at least Author privileges to upload and deserialize a PHAR file, leading to arbitrary PHP object deserialization. We were able to escalate this vulnerability to remote code execution, without the need for additional code More