Acato WP REST Cache Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the Acato WP REST Cache plugin for WordPress, affecting versions through 2025.1.0. This vulnerability arises from improper control of filenames in include or require statements, allowing for the inclusion of local files on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files on the server, with the potential to display sensitive information, such as database credentials, which could allow for a complete takeover of the database, depending on the configuration.

Remediation

Users of the Acato WP REST Cache plugin should update to version 2025.1.1 or later. Patchstack users can enable auto-update for vulnerable plugins.