WP FASTEST CACHE SQLI EXPOSES 600K VULNERABLE WORDPRESS SITES

Summary from the TLDR InfoSec newsletter

The is_user_admin function of the WP Fastest Cache plugin extracts the username from cookies to check if a user is an admin. However, the username is not sanitized and thereby can lead to SQL injection. A patched version of the plugin has been released. WPScan will be releasing its proof-of-concept exploit on November 27, 2023.