Unauthenticated Blind SQL Injection in WP Fastest Cache

The WordPress plugin WP Fastest Cache, in versions 1.2.2 and earlier, is vulnerable to a time-based blind SQL injection (SQLi) attack. An unauthenticated attacker can exploit this flaw by sending specifically crafted HTTP requests containing a malicious wordpress_logged_in cookie. The injection point exists within the plugin's handling of this cookie, which fails to sanitize input before using it in database queries. By leveraging time-based SQL operators such as SLEEP(), an attacker can extract sensitive information from the wp_users table, including hashed user passwords and email addresses. A functional proof-of-concept exploit is publicly available, significantly increasing the risk of exploitation for sites running outdated versions of the plugin.

Attack Chain

1. Attacker identifies a target WordPress site running WP Fastest Cache version <= 1.2.2.
2. Attacker crafts an HTTP request targeting the site, injecting SQL injection syntax into the wordpress_logged_in cookie.
3. The malicious cookie payload includes a SQL IF statement and a SLEEP() command (e.g., AND (IF((SELECT user_pass FROM wp_users WHERE user_login="admin") LIKE 'a%', SLEEP(5), 0))-- -).
4. The plugin processes the crafted cookie and executes the injected SQL command against the WordPress backend database.
5. The attacker observes the response latency of the server to confirm if the condition in the SQL statement is true (a successful guess returns a delayed response).
6. The attacker iterates this process character by character to exfiltrate hashed user passwords and email addresses.
7. Exfiltrated hashes are processed offline using tools like hashcat or john to recover plain-text credentials.

Impact

Successful exploitation allows unauthenticated attackers to bypass access controls and steal account information for registered WordPress users, including administrators. This leads to the compromise of user credentials, which can then be used to gain unauthorized administrative access to the WordPress site, leading to full site takeover, malware distribution, or further network exploitation.

Recommendation

• Update the WP Fastest Cache plugin to version 1.2.3 or later immediately.
• If an immediate update is not possible, disable the plugin until a patch is applied.
• Configure a Web Application Firewall (WAF) to inspect and block HTTP requests containing SQL injection patterns within the wordpress_logged_in cookie field.
• Review database access logs and web server logs for suspicious requests involving repetitive delays or SQL injection characters in cookie headers.