A very serious vulnerability (remote code execution) was discovered in two of the biggest WordPress caching plugins, WP Super Cache and W3 Total Cache (W3TC). Remote code execution “is used to describe an attacker’s ability to execute any commands of the attacker’s choice on a target machine or in a target process” – Wikipedia.
The vulnerability, which affects every WordPress installation which have comments enabled was reported on the official WordPress.org Forums by a user called Kisscsaby. The whole forum thread can be found here. Well done for the plugin developers who 6 days ago released a new and fixed version of the plugins. You can find a more detailed description of what the exploit was from Frank Goossens’ blog.
The best way to ensure that your WordPress is not vulnerable to remote code execution is to upgrade your WordPress caching plugin.
Test if your WordPress is Vulnerable
To test if your WordPress is vulnerable to remote code execution, try to post a comment with the below syntax in the comment area:
<!–mfunc echo PHP_VERSION; –><!–/mfunc–>
If instead of your actual text you see a number, such as 5.2.17 then your WordPress is vulnerable. The number showing in the comment is the version of PHP you are running. This means that an attacker can pass any commands he or she wants to your server and they will be executed. That is why it is called remote code execution.
Remedy for Exploited WordPress Vulnerability
If you are running one of the vulnerable caching plugin and someone already exploited it, restore a clean backup of your WordPress in an offline location and manually restore back any comments you might have lost. Make sure you update the vulnerable WordPress caching plugin before pushing any updates to the live website. To upgrade your plugin, follow the below links:
