PT-2024-37173 · WordPress · Wp2Speed Faster – Optimize Pagespeed Insights Score
Lucio Sá
·
Published
2024-07-09
·
Updated
2024-07-09
·
CVE-2024-5810
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress versions up to, and including, 1.0.1
Description:
The issue is due to the use of hardcoded credentials to authenticate all incoming API requests. This allows unauthenticated attackers to overwrite CSS, update trial settings, purge the cache, and find attachments.
Recommendations:
For versions up to, and including, 1.0.1, consider disabling the plugin until a patch is available to prevent unauthorized access.
Restrict access to the plugin's API endpoints to minimize the risk of exploitation.
Avoid using the plugin until the issue is resolved with a newer version that does not use hardcoded credentials for authentication.
Fix
Using Hardcoded Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp2Speed Faster – Optimize Pagespeed Insights Score