Lucene search

WordfenceCVELIST:CVE-2024-5810

HistoryJul 09, 2024 - 8:33 a.m.

CVE-2024-5810 WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials

2024-07-0908:33:03

Wordfence

www.cve.org

cve-2024-5810

wp2speed faster

hardcoded credentials

unauthorized access

wordpress

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

25.2%

JSON

The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.

CNA Affected

[
  {
    "vendor": "wp2speed",
    "product": "WP2Speed Faster – Optimize PageSpeed Insights Score 90-100",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.0.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152

plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165

plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263

plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372

plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71

www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

25.2%

JSON

Related for CVELIST:CVE-2024-5810