Missing Authorization in WP Fastest Cache Varnish Cache Actions

Skrevet den af i WP Fastest Cache

The Varnish integration in WP Fastest Cache exposed AJAX actions that save, start, pause and remove the Varnish configuration, and an action that purges the Varnish cache, while verifying only a nonce and never the caller’s capabilities. Any authenticated user able to obtain the nonce could change the site’s Varnish server settings or force a full cache purge. The fix requires the manage_options capability in all five handlers and rejects requests where the nonce parameter is absent.

This vulnerability affects the following application versions:

  • WP Fastest Cache 0.9.0.3
  • WP Fastest Cache 0.9.0.4
  • WP Fastest Cache 0.9.0.5
  • WP Fastest Cache 0.9.0.6
  • WP Fastest Cache 0.9.0.7
  • WP Fastest Cache 0.9.0.8
  • WP Fastest Cache 0.9.0.9
  • WP Fastest Cache 0.9.1.0
  • WP Fastest Cache 0.9.1.1
  • WP Fastest Cache 0.9.1.2
  • WP Fastest Cache 0.9.1.3
  • WP Fastest Cache 0.9.1.4
  • WP Fastest Cache 0.9.1.5
  • WP Fastest Cache 0.9.1.6
  • WP Fastest Cache 0.9.1.7
  • WP Fastest Cache 0.9.1.8
  • WP Fastest Cache 0.9.1.9
  • WP Fastest Cache 0.9.2
  • WP Fastest Cache 0.9.3
  • WP Fastest Cache 0.9.4
  • WP Fastest Cache 0.9.5
  • WP Fastest Cache 0.9.6
  • WP Fastest Cache 0.9.7
  • WP Fastest Cache 0.9.8
  • WP Fastest Cache 0.9.9
  • WP Fastest Cache 1.0.0
  • WP Fastest Cache 1.0.1
  • WP Fastest Cache 1.0.2
  • WP Fastest Cache 1.0.3
  • WP Fastest Cache 1.0.4
  • WP Fastest Cache 1.0.5
  • WP Fastest Cache 1.0.6
  • WP Fastest Cache 1.0.7
  • WP Fastest Cache 1.0.8
  • WP Fastest Cache 1.0.9
  • WP Fastest Cache 1.1.0
  • WP Fastest Cache 1.1.1
  • WP Fastest Cache 1.1.2
  • WP Fastest Cache 1.1.3
  • WP Fastest Cache 1.1.4
  • WP Fastest Cache 1.1.5
  • WP Fastest Cache 1.1.6
  • WP Fastest Cache 1.1.7
  • WP Fastest Cache 1.1.8
  • WP Fastest Cache 1.1.9
  • WP Fastest Cache 1.2.0
  • WP Fastest Cache 1.2.1
  • WP Fastest Cache 1.2.2
  • WP Fastest Cache 1.2.3
  • WP Fastest Cache 1.2.4
  • WP Fastest Cache 1.2.5
  • WP Fastest Cache 1.2.6
  • WP Fastest Cache 1.2.7
  • WP Fastest Cache 1.2.8
  • WP Fastest Cache 1.2.9
  • WP Fastest Cache 1.3.0
  • WP Fastest Cache 1.3.1
  • WP Fastest Cache 1.3.2
  • WP Fastest Cache 1.3.3
  • WP Fastest Cache 1.3.4
  • WP Fastest Cache 1.3.5
  • WP Fastest Cache 1.3.6
  • WP Fastest Cache 1.3.7
  • WP Fastest Cache 1.3.8
  • WP Fastest Cache 1.3.9
  • WP Fastest Cache 1.4.0
  • WP Fastest Cache 1.4.1
  • WP Fastest Cache 1.4.2
  • WP Fastest Cache 1.4.3
  • WP Fastest Cache 1.4.4
  • WP Fastest Cache 1.4.5
  • WP Fastest Cache 1.4.6
  • WP Fastest Cache 1.4.7
  • WP Fastest Cache 1.4.8
  • WP Fastest Cache 1.4.9
  • WP Fastest Cache 1.5.0
  • WP Fastest Cache 1.5.1

Input Validation in WP Fastest Cache Cache File Path

Skrevet den af i WP Fastest Cache

WP Fastest Cache derives the on-disk cache file path from the incoming request URL. Before 1.4.5 that path was not trimmed of surrounding whitespace, and a path of exactly “/” was accepted, so a crafted request could steer the plugin to read or write a cache entry at an unintended location — alongside the existing guards that reject “..” and “//” sequences. Version 1.4.5 trims the path and rejects a bare “/” before it is used.

This vulnerability affects the following application versions:

  • WP Fastest Cache 1.1.5
  • WP Fastest Cache 1.1.6
  • WP Fastest Cache 1.1.7
  • WP Fastest Cache 1.1.8
  • WP Fastest Cache 1.1.9
  • WP Fastest Cache 1.2.0
  • WP Fastest Cache 1.2.1
  • WP Fastest Cache 1.2.2
  • WP Fastest Cache 1.2.3
  • WP Fastest Cache 1.2.4
  • WP Fastest Cache 1.2.5
  • WP Fastest Cache 1.2.6
  • WP Fastest Cache 1.2.7
  • WP Fastest Cache 1.2.8
  • WP Fastest Cache 1.2.9
  • WP Fastest Cache 1.3.0
  • WP Fastest Cache 1.3.1
  • WP Fastest Cache 1.3.2
  • WP Fastest Cache 1.3.3
  • WP Fastest Cache 1.3.4
  • WP Fastest Cache 1.3.5
  • WP Fastest Cache 1.3.6
  • WP Fastest Cache 1.3.7
  • WP Fastest Cache 1.3.8
  • WP Fastest Cache 1.3.9
  • WP Fastest Cache 1.4.0
  • WP Fastest Cache 1.4.1
  • WP Fastest Cache 1.4.2
  • WP Fastest Cache 1.4.3
  • WP Fastest Cache 1.4.4

Missing Authorization in WP Fastest Cache Specific-Pages Cache Clearing

Skrevet den af i WP Fastest Cache

The AJAX handlers that add, remove and list the “clear cache on specific pages” rules in WP Fastest Cache verified only a nonce and never checked the caller’s capabilities. Any authenticated user who could obtain the nonce from an admin page could change or read the site’s cache-clearing rules. The fix requires the manage_options capability before the request is processed and rejects requests where the nonce parameter is absent.

This vulnerability affects the following application versions:

  • WP Fastest Cache 1.0.7
  • WP Fastest Cache 1.0.8
  • WP Fastest Cache 1.0.9
  • WP Fastest Cache 1.1.0
  • WP Fastest Cache 1.1.1
  • WP Fastest Cache 1.1.2
  • WP Fastest Cache 1.1.3
  • WP Fastest Cache 1.1.4
  • WP Fastest Cache 1.1.5
  • WP Fastest Cache 1.1.6
  • WP Fastest Cache 1.1.7
  • WP Fastest Cache 1.1.8
  • WP Fastest Cache 1.1.9
  • WP Fastest Cache 1.2.0
  • WP Fastest Cache 1.2.1
  • WP Fastest Cache 1.2.2
  • WP Fastest Cache 1.2.3
  • WP Fastest Cache 1.2.4
  • WP Fastest Cache 1.2.5
  • WP Fastest Cache 1.2.6
  • WP Fastest Cache 1.2.7
  • WP Fastest Cache 1.2.8
  • WP Fastest Cache 1.2.9
  • WP Fastest Cache 1.3.0
  • WP Fastest Cache 1.3.1
  • WP Fastest Cache 1.3.2
  • WP Fastest Cache 1.3.3
  • WP Fastest Cache 1.3.4
  • WP Fastest Cache 1.3.5
  • WP Fastest Cache 1.3.6
  • WP Fastest Cache 1.3.7
  • WP Fastest Cache 1.3.8
  • WP Fastest Cache 1.3.9
  • WP Fastest Cache 1.4.0
  • WP Fastest Cache 1.4.1
  • WP Fastest Cache 1.4.2
  • WP Fastest Cache 1.4.3
  • WP Fastest Cache 1.4.4
  • WP Fastest Cache 1.4.5
  • WP Fastest Cache 1.4.6
  • WP Fastest Cache 1.4.7
  • WP Fastest Cache 1.4.8
  • WP Fastest Cache 1.4.9
  • WP Fastest Cache 1.5.0
  • WP Fastest Cache 1.5.1