PT-2023-7326 · WordPress · Swift Performance Lite
Krzysztof Zając
·
Published
2023-11-24
·
Updated
2023-12-21
·
CVE-2023-6289
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Swift Performance Lite versions prior to 2.3.6.15
Description
The issue is related to the insufficient authorization procedure in the admin init() function of the Swift Performance Lite WordPress plugin. This may allow a remote attacker to gain unauthorized access to protected information. The plugin's settings, which can include sensitive information such as Cloudflare API tokens, can be exported by users.
Recommendations
For versions prior to 2.3.6.15, update to version 2.3.6.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings export functionality to minimize the risk of exploitation.
Exploit
Fix
Missing Authorization
Improper Authentication
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Swift Performance Lite