WP Super Cache stores the CDN URL and CNAME settings unescaped and substitutes them into the src/href attribute of every rewritten asset URL, so a value containing a quote or an angle bracket breaks out of the attribute and executes script for every visitor. String settings and direct-page paths are written to the cache config file as raw PHP source, so a value carrying a quote or a trailing backslash corrupts a file that is included before WordPress boots. Separately, the auth-cookie scan stopped at the first cookie whose name is falsy, so a visitor sending a cookie named “0” was treated as anonymous and the logged-in page rendered for them was written to the public cache and served to everyone.
This vulnerability affects the following application versions:
- WP Supercache 1.7.1
- WP Supercache 1.7.2
- WP Supercache 1.7.3
- WP Supercache 1.7.4
- WP Supercache 1.7.5
- WP Supercache 1.7.6
- WP Supercache 1.7.7
- WP Supercache 1.7.8
- WP Supercache 1.7.9
- WP Supercache 1.8
- WP Supercache 1.9
- WP Supercache 1.9.1
- WP Supercache 1.9.2
- WP Supercache 1.9.2-beta
- WP Supercache 1.9.2-beta2
- WP Supercache 1.9.2-beta3
- WP Supercache 1.9.3
- WP Supercache 1.9.3-beta
- WP Supercache 1.9.4
- WP Supercache 1.9.4-beta
- WP Supercache 1.10.0
- WP Supercache 1.10.0-beta
- WP Supercache 1.11.0
- WP Supercache 1.12.0
- WP Supercache 1.12.1
- WP Supercache 1.12.2
- WP Supercache 1.12.3
- WP Supercache 1.12.4
- WP Supercache 2.0.0
- WP Supercache 2.0.0-beta
- WP Supercache 2.0.1
- WP Supercache 3.0.0
- WP Supercache 3.0.1
- WP Supercache 3.0.2
- WP Supercache 3.0.3
- WP Supercache 3.1.0
- WP Supercache 3.1.1