{"id":22362,"date":"2025-04-12T18:58:44","date_gmt":"2025-04-12T18:58:44","guid":{"rendered":""},"modified":"2025-08-30T04:38:53","modified_gmt":"2025-08-30T10:38:53","slug":"cve-2021-24869-sql-injection-vulnerability-in-wp-fastest-cache-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2021-24869-sql-injection-vulnerability-in-wp-fastest-cache-wordpress-plugin\/","title":{"rendered":"<strong>CVE-2021-24869: SQL Injection Vulnerability in WP Fastest Cache WordPress Plugin<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The CVE-2021-24869 vulnerability is a critical security flaw in the WP Fastest Cache WordPress plugin. This vulnerability potentially affects millions of websites running on WordPress that utilize this specific plugin. The flaw lies in the inability of versions prior to 0.9.5 to properly sanitize user input, leading to potential <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-47460-sql-injection-vulnerability-in-knovos-discovery-v-22-67-0\/\"  data-wpil-monitor-id=\"27375\">SQL injection<\/a> attacks. This opens the door to <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-2815-unauthorized-modification-of-data-in-administrator-z-wordpress-plugin\/\"  data-wpil-monitor-id=\"29775\">unauthorized access to sensitive data<\/a>, or even complete system compromise, making it a high-risk vulnerability that demands immediate attention.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2021-24869<br \/>\nSeverity: High (8.8 CVSS score)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: Low (Subscriber level)<br \/>\nUser Interaction: Required<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-0573-critical-vulnerability-in-totolink-lr1200gb-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"29256\">Potential system<\/a> compromise or data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-1297986467\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>WP Fastest Cache <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-2005-critical-vulnerability-in-the-wordpress-plugin-front-end-users-feup\/\"  data-wpil-monitor-id=\"26016\">WordPress Plugin<\/a> | Before 0.9.5<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The flaw in the WP Fastest Cache <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6220-piotnet-forms-plugin-vulnerability-in-wordpress-allows-arbitrary-file-uploads\/\"  data-wpil-monitor-id=\"34542\">WordPress plugin<\/a> comes from its failure to properly sanitize user input in the `set_urls_with_terms` method before using it in an SQL statement. In practice, this means that an attacker with low-level privileges, such as a subscriber, could send a specially crafted <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-46458-critical-cross-site-request-forgery-csrf-vulnerability-leading-to-sql-injection-in-occupancyplan\/\"  data-wpil-monitor-id=\"55440\">request containing malicious SQL<\/a> commands. When processed, these <a href=\"https:\/\/www.ameeba.com\/blog\/nsa-and-cyber-command-executives-withdraw-from-premier-cybersecurity-conference-unpacking-the-implications\/\"  data-wpil-monitor-id=\"29255\">commands would be executed<\/a> directly on the database, potentially allowing unauthorized data access, data manipulation, or even full system control.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-1216342365\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Here&#8217;s a conceptual example of how the <a href=\"https:\/\/www.ameeba.com\/blog\/fortinet-s-fortigate-vulnerability-ssl-vpn-symlink-exploit-puts-user-access-at-risk-post-patching\/\"  data-wpil-monitor-id=\"32372\">vulnerability might be exploited<\/a>. This is not actual exploit code, but it helps to <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-49526-out-of-bounds-write-vulnerability-in-illustrator-leading-to-arbitrary-code-execution\/\"  data-wpil-monitor-id=\"75203\">illustrate the nature of the vulnerability:<\/a><\/p>\n<pre><code class=\"\" data-line=\"\">POST \/wpfc_set_urls_with_terms HTTP\/1.1\nHost: vulnerable-wordpress-site.com\nContent-Type: application\/json\n{ &quot;urls_with_terms&quot;: &quot;&#039;; DROP TABLE users; --&quot; }<\/code><\/pre>\n<p>In the above example, the malicious payload `&#8217;; DROP TABLE users; &#8211;` is sent as part of the `urls_with_terms` parameter in a <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-4829-critical-buffer-overflow-vulnerability-in-totolink-http-post-request-handler\/\"  data-wpil-monitor-id=\"55441\">POST request<\/a>. This would result in the SQL command `DROP TABLE users;` being executed directly on the database, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-0576-critical-vulnerability-in-totolink-lr1200gb-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"29404\">potentially leading<\/a> to detrimental effects.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>Users of the WP Fastest Cache <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-3211-unauthenticated-sql-injection-vulnerability-in-wordpress-database-administrator-plugin\/\"  data-wpil-monitor-id=\"29966\">WordPress plugin<\/a> are urged to update to version 0.9.5 or later as soon as possible. In the event that immediate patching is not feasible, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as a temporary mitigation measure. These systems can help detect and block malicious <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2023-6373-sql-injection-vulnerability-in-artplacer-widget-wordpress-plugin\/\"  data-wpil-monitor-id=\"29840\">SQL injection<\/a> attempts. Additionally, regular database backups and limiting unnecessary <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-31524-privilege-escalation-vulnerability-in-notfound-wp-user-profiles\/\"  data-wpil-monitor-id=\"32371\">user privileges<\/a> can also contribute to minimizing the impact of potential exploitation.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The CVE-2021-24869 vulnerability is a critical security flaw in the WP Fastest Cache WordPress plugin. This vulnerability potentially affects millions of websites running on WordPress that utilize this specific plugin. The flaw lies in the inability of versions prior to 0.9.5 to properly sanitize user input, leading to potential SQL injection attacks. This opens [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[74],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-22362","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-sql-injection"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/22362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=22362"}],"version-history":[{"count":12,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/22362\/revisions"}],"predecessor-version":[{"id":67799,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/22362\/revisions\/67799"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=22362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=22362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=22362"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=22362"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=22362"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=22362"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=22362"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=22362"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=22362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}