CVE-2023-6063: Unauthenticated SQLi WordPress Plugin Bug Affects Over 1M Sites

The WP Fastest Cache plugin for WordPress is a popular plugin that improves the performance of WordPress websites by caching static HTML files. However, a recently discovered security vulnerability in the plugin could allow unauthenticated attackers to inject malicious SQL code into the database of WordPress websites that use the plugin.

The vulnerability, CVE-2023-6063, is rated as critical by the Common Vulnerability Scoring System (CVSS) with a score of 9.8. This means that it is a very serious vulnerability that could allow attackers to take control of affected websites.

The vulnerability is caused by insufficient escaping of the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

“The WP Fastest Cache plugin for WordPress is vulnerable to SQL Injection via the ‘$username’ variable retrieved via user cookies in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,” read the Wordfence Intelligence website.

What Can Hackers Do With This Vulnerability?

If an attacker can exploit this vulnerability, they could gain access to the WordPress database and extract sensitive information, such as user passwords, credit card numbers, and other sensitive data. They could also use the vulnerability to inject malicious code into the database, which could then be used to deface or take control of the website.

Who Is Affected by This Vulnerability?

Any WordPress website that uses the WP Fastest Cache plugin is affected by the CVE-2023-6063 vulnerability. This includes over 1 million websites, according to the WordPress plugin directory.

What Can Website Owners Do to Protect Themselves?

The best way to protect yourself from this vulnerability is to update to the latest version of the WP Fastest Cache plugin. The developer has released a patch for the vulnerability in version 1.2.2.

If you are unable to update to the latest version of the plugin, you can take the following steps to mitigate the risk of being exploited:

• Disable the plugin.
• Use a firewall to block access to the plugin’s vulnerable endpoints.
• Implement a web application firewall (WAF) to protect your website from SQL injection attacks.