PT-2023-7326 · WordPress · Swift Performance Lite
Krzysztof Zając
·
Publicado
2023-11-24
·
Atualizado
2023-12-21
·
CVE-2023-6289
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Swift Performance Lite versions prior to 2.3.6.15
Description
The issue is related to the insufficient authorization procedure in the admin init() function of the Swift Performance Lite WordPress plugin. This may allow a remote attacker to gain unauthorized access to protected information. The plugin's settings, which can include sensitive information such as Cloudflare API tokens, can be exported by users.
Recommendations
For versions prior to 2.3.6.15, update to version 2.3.6.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings export functionality to minimize the risk of exploitation.
Exploit
Correção
Missing Authorization
Improper Authentication
Missing Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Swift Performance Lite