Multiple vulnerabilities in WP Fastest Cache plugin

Marc Montpas posted: " During an internal audit of the WP Fastest Cache plugin, we uncovered an Authenticated SQL Injection vulnerability and a Stored XSS (Cross-Site Scripting) via Cross-Site Request Forgery (CSRF) issue. If exploited, the SQL Injection bug could grant att" New post on Jetpack: WordPress Security, Performance, and Growth Multiple vulnerabilities in WP Fastest Cache plugin by Marc Montpas During an internal audit of the WP Fastest Cache plugin, we uncovered an Authenticated SQL Injection vulnerability and a Stored XSS (Cross-Site Scripting) via Cross-Site Request Forgery (CSRF) issue. If exploited, the SQL Injection bug could grant attackers access to privileged information from the affected site's database (e.g., usernames and hashed passwords). It can only be exploited if the classic-editor plugin is also installed and activated on the site.  Successfully exploiting the CSRF & Stored XSS vulnerability could enable bad actors to perform any action the logged-in administrator they targeted is allowed to do on the targeted site. We reported the vulnerabilities to this plugin's author via email, and they recently released version 0.9.5 to address them. We strongly recommend that you update to the latest version of the plugin and have an established security solution on your site, such as Jetpack Security. Read more of this post Marc Montpas | October 14, 2021 at 11:51 am | Tags: Jetpack, scan, Security | Categories: scan, Security, Vulnerabilities | URL: https://wp.me/p1moTy-yDr Unsubscribe to no longer receive posts from Jetpack: WordPress Security, Performance, and Growth. Change your email settings at Manage Subscriptions. Trouble clicking? Copy and paste this URL into your browser: http://jetpack.com/2021/10/14/multiple-vulnerabilities-in-wp-fastest-cache-plugin/ Thanks for flying with WordPress.com