CVE-2024-5810: falha de média gravidade em WP2Speed Faster – Optimize PageSpeed Insights…
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Referências
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve