CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - ثغرة في التفويض تؤدي إلى تصدير الإعدادات بدون مصادقة الوصف إضافة Swift Performance Lite لووردبريس معرضة للوصول غير المصرح به للبيانات بسبب عدم وجود فحص للصلاحية في الوظيفة المرتبطة عبر admininit في جميع الإصدارات حتى 2.3.6.14. وهذا يسمح للمهاجمين...

CVE-2025-14437: Insertion of Sensitive Information into Log File

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials...

CVE-2023-6289

The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens...

Episode 2: Behind the Scenes of a Tailor-Made Massive Phishing Campaign Part 2

Executive Summary Last summer, we investigated a massive, global phishing campaign impersonating almost 350 legitimate companies. Our continued investigation into this expansive phishing campaign revealed leaked backend source code, shedding light on the infrastructure behind the operation. This...

PT-2024-15389

Name of the Vulnerable Software and Affected Versions Cloudflare Wordpress plugin affected versions not specified Description The issue is related to improper authentication, allowing attackers with lower privileged accounts to access data from the Cloudflare API. Recommendations At the moment,...

CVE-2023-6289

The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens...

Information disclosure

The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens...

CVE-2023-6289 Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export

The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens...

CVE-2023-6289

CVE-2023-6289 affects the WordPress plugin Swift Performance Lite up to version 2.3.6.14. Root cause: missing authorization check on an admin-ajax exported function (luv-action export) via admin_init, allowing unauthenticated retrieval of plugin settings that may include Cloudflare API tokens. Im...

WordPress Plugin Swift Performance Lite Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-6289: Undefined Security Weakness

The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens...

Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export

Description The plugin does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens. PoC curl --url 'http://vulnerable-site.tld/wp-admin/admin-post.php?luv-action=export'...

A new skimmer uses WebSockets and a fake credit card form to steal sensitive data

A new skimmer attack was discovered this week, targeting various online e-commerce sites built with different frameworks. As of the writing of this blog post, the attack is still active and exfiltrating data. Attackers are exploiting an expanding in-browser attack surface and continually evolving...