PT-2023-16902 · WordPress · Rapidload Power-Up For Autoptimize

Marco Wotschka · Published 2023-03-10 · Updated 2026-02-13 · CVE-2023-1333

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions RapidLoad Power-Up for Autoptimize plugin for WordPress versions up to, and including, 1.7.1

Description The issue is related to a missing capability check on the clear page cache function, allowing authenticated attackers with subscriber-level access to delete the plugin's cache. This can lead to unauthorized loss of data.

Recommendations For versions up to, and including, 1.7.1, consider disabling the clear page cache function until a patch is available to prevent unauthorized cache deletion. Restrict access to the cache management functionality to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-1333

Affected Products

Rapidload Power-Up For Autoptimize

References · 9

• https://osv.dev/vulnerability/CVE-2023-1333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1333 · Security Note
• https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php · Patch
• https://t.me/cvenotify/46002 · Telegram Post
• https://t.me/cibsecurity/59823 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2cba74f7-7183-4297-8f04-4818c01358ef?source=cve · Note
• https://t.me/cvenotify/46182 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2cba74f7-7183-4297-8f04-4818c01358ef · Note
• https://t.me/cveNotify/152003 · Telegram Post