Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wp-plugins/wp-super-cache

              master @ 76d7b34
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Reflected XSS: 2 prior fixes. Scrutinize any change in this area.

wp-cache.php: most-fixed (4 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The processing of dynamic cache tags such as mfunc and mclude from untrusted inputs like user comments allowed attackers to execute arbitrary code within the caching engine. Preventing this requires rigorous comment filtering before caching.

Remote Code Execution: Unsafe generation of configuration files using functions like wp_cache_replace_line can lead to code injection if values like cache secret keys are not correctly quoted or validated before being written.

Reflected XSS: Unsanitized use of $_SERVER['REQUEST_URI'] and page action URLs in administrative templates allowed attackers to execute arbitrary scripts in the context of an administrator session.