Actu
Vigil@nce - WordPress: privilege escalation via W3 Total Cache
May 2013 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can inject PHP code in W3 Total Cache of WordPress, in
order to escalate his privileges.
Impacted products: WordPress
Severity: 2/4
Creation date: 23/04/2013
Revision date: 25/04/2013
DESCRIPTION OF THE VULNERABILITY
The W3 Total Cache plugin is used to optimize the page loading.
However, the mfunc and mclude macros can contain PHP code.
An attacker can therefore inject PHP code in W3 Total Cache of
WordPress, in order to escalate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/WordPress-privilege-escalation-via-W3-Total-Cache-12706
