Cache Enabler <= 1.8.16 - Unauthenticated Arbitrary File and Directory Deletion
criticalThe Cache Enabler plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.16. This is due to missing path confinement validation in the cache directory resolution logic, allowing URL-supplied path traversal sequences to resolve outside the plugin cache directory. This makes it pos...
- CVSS:
- 9.1 (Wordfence)
- Affected:
- up to 1.8.16
- Fixed in:
- 1.8.17
- Disclosed:
- Sep 29, 2026