What’s Vulnerable › Vulnerabilities

CVE-2017-11658

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-07-26 · updated 2026-06-17
• Weakness: CWE-22

Description

In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.

Affected products

• Wp-Rocket: 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5 (+104)

References

• https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890
• https://wp-rocket.me/changelog
• https://wpvulndb.com/vulnerabilities/8872
• https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890
• https://wp-rocket.me/changelog
• https://wpvulndb.com/vulnerabilities/8872

Get alerted when CVE-2017-11658 or the next vulnerability affects your stack