What’s Vulnerable › Vulnerabilities

CVE-2021-24869: WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-16 · updated 2026-06-17
• Weakness: CWE-89

Description

The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber

Affected products

• emrevona WP Fastest Cache – WordPress Cache Plugin: before 0.9.5 — fixed in 0.9.5

How to fix

Upgrade to a fixed version: emrevona WP Fastest Cache – WordPress Cache Plugin 0.9.5. Check the vendor advisory for mitigations.

References

• https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/
• https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/
• https://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/
• https://wpscan.com/vulnerability/b2233795-1a32-45fc-9d51-b6bd0a073f5b/

Get alerted when CVE-2021-24869 or the next vulnerability affects your stack