CVE-2015-9316

CRITICAL

WP Fastest Cache < 0.8.4.9 - SQL Injection via poll_id Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-9316. PoCs published by Kacper Szurek.

AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in WP Fastest Cache 0.8.4.8 when used with WP-Polls. The `poll_id` parameter is improperly sanitized, allowing an attacker to inject malicious SQL queries.

Description

The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.

Exploits (1)

exploitdb WORKING POC
by Kacper Szurek · textwebappsphp
https://www.exploit-db.com/exploits/38678

This exploit demonstrates a blind SQL injection vulnerability in WP Fastest Cache 0.8.4.8 when used with WP-Polls. The `poll_id` parameter is improperly sanitized, allowing an attacker to inject malicious SQL queries.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WP Fastest Cache 0.8.4.8 (with WP-Polls installed)
No auth needed
Prerequisites: WP-Polls plugin installed · Access to the WordPress admin-ajax.php endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/wp-fastest-cache/#developers
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.exploit-db.com/exploits/38678

Scores

CVSS v3 9.8
EPSS 0.0148
EPSS Percentile 81.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
wpfastestcache/wp_fastest_cache < 0.8.4.9
Published Aug 14, 2019
Tracked Since Feb 18, 2026