CVE-2021-24209
📋 TL;DR
This vulnerability allows authenticated WordPress administrators (or users with admin privileges) to execute arbitrary code on servers running vulnerable versions of the WP Super Cache plugin. Attackers can exploit input validation failures and weak path checks in the plugin's settings page to inject web shells, leading to remote code execution. Only WordPress sites with the WP Super Cache plugin installed and active are affected.
💻 Affected Systems
- WordPress WP Super Cache Plugin
📦 What is this software?
Wp Super Cache by Automattic
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, steal data, install persistent backdoors, or pivot to other systems.
Likely Case
Attackers gain web shell access leading to data exfiltration, defacement, or installation of cryptocurrency miners/malware.
If Mitigated
Limited impact if proper access controls restrict admin privileges and file permissions are properly configured.
🎯 Exploit Status
Exploitation requires admin-level credentials but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.2 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2496238/wp-super-cache
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Super Cache and click 'Update Now'. 4. Alternatively, download version 1.7.2+ from WordPress.org and manually replace plugin files.
🔧 Temporary Workarounds
Restrict wp-cache-config.php access
linuxAdd .htaccess rules to block direct access to the vulnerable configuration file
<Files "wp-cache-config.php">
Order Allow,Deny
Deny from all
</Files>
Remove admin privileges
allReview and reduce admin-level users to only essential personnel
🧯 If You Can't Patch
- Disable WP Super Cache plugin immediately
- Implement strict file permissions (644 for wp-cache-config.php) and monitor for unauthorized modifications
🔍 How to Verify
Check if Vulnerable:
Check WP Super Cache plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
grep "Version:" wp-content/plugins/wp-super-cache/wp-cache.phpVerify Fix Applied:
Confirm plugin version is 1.7.2 or higher and test that wp-cache-config.php cannot be directly accessed📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/options-general.php?page=wpsupercache
- File modifications to wp-cache-config.php
- Suspicious PHP code in cache configuration files
Network Indicators:
- Unexpected outbound connections from web server following admin panel access
SIEM Query:
source="web_access.log" AND (uri="/wp-admin/options-general.php" AND params LIKE "%page=wpsupercache%")