CVE-2023-6063
Published: 04 December 2023
Summary
CVE-2023-6063 is a high-severity SQL Injection (CWE-89) vulnerability in Wpfastestcache Wp Fastest Cache. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2023-6063 is an unauthenticated SQL injection flaw present in the WP Fastest Cache WordPress plugin prior to version 1.2.2. It arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement, corresponding to CWE-89 and carrying a CVSS 3.1 score of 7.5 that reflects high confidentiality impact over a network vector with no required privileges or user interaction.
An attacker with no authentication can supply a crafted parameter to the affected plugin endpoint, enabling direct execution of arbitrary SQL queries against the underlying database and potential extraction of sensitive data such as user credentials or site configuration.
Public advisories published by WPScan state that the flaw was resolved in plugin release 1.2.2 and explicitly advise site administrators to update immediately to eliminate the injection vector.
The associated EPSS reaches a current value of 0.9137 with a recorded peak of 0.9221, indicating sustained and elevated exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58320
Vulnerability details
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.