WP Fastest Cache CVE-2020-36836

The target must be running the WP Fastest Cache WordPress plugin at version 0.9.0.2 or earlier with the vulnerable cache-deletion endpoint exposed (the default plugin installation). Exploitation requires either (a) an authenticated low-privileged WordPress account such as Subscriber - which is trivially available on sites with open registration but blocked on sites that disable user registration - or (b) via the CWE-352 CSRF path, a logged-in higher-privileged user (e.g., administrator) being tricked into visiting an attacker-controlled page, which is the UI:R component in the CVSS vector. Limiting factors: sites with user registration disabled and administrators who do not browse external content while logged in materially reduce realistic exploitability; hosting environments that mount wp-config.php or core files as non-deletable by the web server user further blunt impact.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H yields 8.0 (High): network-reachable, low-complexity, requiring only minimal privileges and user interaction, with high impact across confidentiality, integrity, and availability - file deletion of wp-config.php or core files can trigger WordPress setup mode and lead to full site takeover. EPSS at 43.15% (97th percentile) is exceptionally high and corroborates the existence of publicly available exploit code. The vulnerability is NOT listed in CISA KEV, so there is no public exploit identified... correction per precision rules: publicly available exploit code exists but there is no confirmed active exploitation via KEV. The UI:R component plus the CSRF tag suggests the most realistic exploitation path is luring an authenticated admin to a malicious page rather than a Subscriber-driven direct call, though the description also implies a direct authenticated-low-privilege path - these two signals are partially conflicting and defenders should treat both as in-scope.

An attacker registers a low-privilege Subscriber account on a target WordPress site running WP Fastest Cache <= 0.9.0.2 (or, leveraging the CSRF nature, hosts a malicious page and lures an already-authenticated admin to visit it) and issues the vulnerable cache-deletion request with a traversal-laden path parameter pointing at wp-config.php. Deleting wp-config.php causes WordPress to enter its initial setup wizard on the next request, allowing the attacker to point the site at an attacker-controlled database and seize full administrative control. Publicly available exploit code reduces the skill barrier significantly.