WordPress Plugin Vulnerabilities

WP Fastest Cache < 1.2.7 - Admin+ Arbitrary File Deletion

Description

The plugin for WordPress is vulnerable to Directory Traversal via the specificDeleteCache function. This makes it possible for authenticated attackers to delete arbitrary files on the server, which can include wp-config.php files of the affected site or other sites in a shared hosting environment.

Affects Plugins

Plugin icon
wp-fastest-cache
Fixed in 1.2.7

References

CVE
CVE-2024-4347
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/634d4062-7004-4e89-89a8-323c939aae93

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Khayal Farzaliyev (shaman0x01)
Verified
No
WPVDB ID
2a31c784-37af-4fa9-924c-727aaa72952a

Timeline

Publicly Published
2024-05-10 (about 2 years ago)
Added
2024-05-23 (about 1 year ago)
Last Updated
2026-04-13 (about 29 days ago)

Other

Published
Title
Published
2025-08-25
Title
Jannah < 7.5.1 - Unauthenticated Local File Inclusion
Published
2024-12-30
Title
WPMasterToolKit < 1.14.0 - Authenticated (Admin+) Arbitrary File Download
Published
2025-01-16
Title
Eventer < 3.9.8 - Authenticated (Subscriber+) Arbitrary File Read
Published
2025-11-07
Title
CYAN Backup < 2.5.5 - Authenticated (Admin+) Arbitrary File Deletion
Published
2015-06-10
Title
Download Zip Attachments <= 1.0 - Arbitrary File Download