W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download

2016-09-26 00:00
SecuPress

Strategic Overview

Status
Patched in 0.9.5
Affected Plugin
W3 Total Cache
Affected Version
<= 0.9.4.1
CVSS
4.9Medium
CVE
CVE pending
View all W3 Total Cache vulnerabilities

At a glance

This record tracks a medium-severity security vulnerability in the W3 Total Cache WordPress plugin, affecting versions <= 0.9.4.1. It carries a CVSS score of 4.9 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires an authenticated account. The issue is fixed in version 0.9.5; sites on affected versions should update now. Disclosed September 2016, reported by SecuPress.

Vulnerability Overview

The W3 Total Cache plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 0.9.4.1 This can allow an administrator attacker to extract sensitive data from wp-config.php that could be used to fully take over the site.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

Remediation

Update to version 0.9.5, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: W3 Total Cache 0.9.5 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/ddd2c5d9-6489-4154-a494-20392f435bc6

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C