Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion

The Cache Enabler plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.16. This is due to missing path confinement validation in the cache directory resolution logic, allowing URL-supplied path traversal sequences to resolve outside the plugin cache directory. This makes it possible for unauthenticated attackers to delete arbitrary files and directories on the server by supplying a crafted URL containing path traversal sequences to the cache-clearing routine. Another plugin or theme passes a request-derived URL to the cache_enabler_clear_page_cache_by_url hook.

Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: Cache Enabler 1.8.17 closes this, and updating the plugin is the step that ends it.

• Firewall
• Scanner
• Login Security