CVE-2021-24209: Automattic Wp Super Cache

High severity, CVSS 7.2. EPSS: 27.7% chance of exploitation in the next 30 days.

The WP Super Cache WordPress plugin before 1.7.2 was affected by an authenticated (admin+) RCE in the settings page due to input validation failure and weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for a web shell injection.

Affected products

• Automattic Wp Super Cache: before 1.7.2 (fixed in 1.7.2)

Published 2021-04-05. Last modified 2026-06-17.