CVE-2017-11658

Name of the Vulnerable Software and Affected Versions WP Rocket plugin version 2.9.3

Description The issue concerns the Local File Inclusion mitigation technique in the WP Rocket plugin, which trims traversal characters (..) but is insufficient to prevent remote attacks. This weakness can be exploited by using 0x00 bytes, as shown in a .%00.../.%00.../ attack.

Recommendations For WP Rocket plugin version 2.9.3, consider disabling the Local File Inclusion feature until a patch is available to prevent potential remote attacks.