CVE-2021-24869
📋 TL;DR
This SQL injection vulnerability in the WP Fastest Cache WordPress plugin allows low-privilege users like subscribers to execute arbitrary SQL commands. Attackers can potentially read, modify, or delete database content, affecting all WordPress sites running vulnerable versions of the plugin.
💻 Affected Systems
- WP Fastest Cache WordPress Plugin
📦 What is this software?
Wp Fastest Cache by Wpfastestcache
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation to administrator, or site takeover.
Likely Case
Data exfiltration from WordPress database, including user credentials, sensitive content, or plugin/theme data.
If Mitigated
Limited impact if proper input validation and prepared statements are implemented.
🎯 Exploit Status
Exploitation requires authenticated user with at least subscriber privileges. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.5 and later
Vendor Advisory: https://wordpress.org/plugins/wp-fastest-cache/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Fastest Cache and click 'Update Now'. 4. Alternatively, download version 0.9.5+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable WP Fastest Cache Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate wp-fastest-cache
Restrict User Registration
allPrevent new user registration to limit potential attackers.
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement web application firewall (WAF) with SQL injection rules
- Restrict database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If WP Fastest Cache version is below 0.9.5, system is vulnerable.Check Version:
wp plugin get wp-fastest-cache --field=versionVerify Fix Applied:
Confirm WP Fastest Cache plugin version is 0.9.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in WordPress/database logs
- Multiple failed login attempts followed by SQL-like payloads in requests
Network Indicators:
- POST requests to wp-admin/admin-ajax.php with SQL payloads in parameters
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND ("SELECT" OR "UNION" OR "INSERT" OR "DELETE")🔗 References
- https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/
- https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/
- https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/
- https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/
