CVE-2024-5810
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials
| Assigner | Wordfence |
| Reserved | 2024-06-10 |
| Published | 2024-07-09 |
| Updated | 2024-08-01 |
The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.
| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
CWE-798 Use of Hard-coded Credentials
| 2024-07-08: | Disclosed |
Lucio Sá
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165
