Lucene search

K
wpvulndbWpvulndbWPVDB-ID:392A6BA8-DB4F-457B-95AE-916B84162797
HistoryDec 19, 2023 - 12:00 a.m.

SpeedyCache < 1.1.4 - Missing Authorization to Plugin Options Update

2023-12-1900:00:00
wpscan.com
8
speedycache
wordpress
vulnerability
unauthorized modification
data
capability check
plugin options
authenticated attackers
subscriber-level access

AI Score

6.2

Confidence

High

EPSS

0

Percentile

14.0%

Description The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options.

AI Score

6.2

Confidence

High

EPSS

0

Percentile

14.0%

Related for WPVDB-ID:392A6BA8-DB4F-457B-95AE-916B84162797