WP Fastest Cache Plugin for WordPress < 1.1.3 Multiple Vulnerabilities

medium Web App Scanning Plugin ID 114027

Language:

Synopsis

Description

The WordPress Fastest Cache Plugin installed on the remote host suffers from multiple vulnerabilities:

- A nonce validation issue on the wpfc_preload_single_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to invoke a cache building action (CVE-2023-1918)

- A nonce validation issue on the wpfc_preload_single_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to change cache related settings (CVE-2023-1919)

- A nonce validation issue on the wpfc_purgecache_varnish_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to purge the varnish cache via a forged request (CVE-2023-1920)

- A nonce validation issue on the wpfc_start_cdn_integration_ajax_request_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to change cdn settings via a forged request (CVE-2023-1921)

- A nonce validation issue on the wpfc_pause_cdn_integration_ajax_request_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to change cdn settings via a forged request (CVE-2023-1922)

- A nonce validation issue on the wpfc_remove_cdn_integration_ajax_request_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to change cdn settings via a forged request (CVE-2023-1923)

- A nonce validation issue on the wpfc_toolbar_save_settings_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to change cache related settings (CVE-2023-1924)

- A nonce validation issue on the wpfc_clear_cache_of_allsites_callback function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to clear caches (CVE-2023-1925)

- A nonce validation issue on the deleteCacheToolbar function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to delete caches (CVE-2023-1926)

- A nonce validation issue on the deleteCssAndJsCacheToolbar function leading to a Cross-Site Request Forgery (CSRF) vulnerability permitting attackers to delete caches (CVE-2023-1927)

- A missing capability check vulnerability on the wpfc_preload_single_callback function permitting attackers with subscriber-level access to initiate cache creation (CVE-2023-1928)

- A missing capability check vulnerability on the wpfc_purgecache_varnish_callback function permitting attackers with subscriber-level access to initiate cache creation (CVE-2023-1929)

- A missing capability check vulnerability on the wpfc_clear_cache_of_allsites_callback function permitting attackers with subscriber-level access to initiate cache creation (CVE-2023-1930)

- A missing capability check vulnerability on the deleteCssAndJsCacheToolbar function permitting attackers with subscriber-level access to initiate cache creation (CVE-2023-1931)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.