CVE-2024-5810CWE-798

WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials

Medium · published July 9, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-07-09T08:33Z
EPSS history
Timeline
  • 09 JUL 08:33Z
    WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials
    cvelistv5