CVE-2023-26543 MEDIUM

CVE-2023-26543: WordPress WP Meteor Page Speed Optimization Topping Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Aleksandr Guidrevitch
Product WP Meteor Website Speed Optimization Addon
Weakness CWE-352 · CSRF
Published November 13, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP Meteor Website Speed Optimization Addon versions up to 3.1.4 are vulnerable to cross-site request forgery (CSRF). An attacker can trick a site administrator into performing unwanted actions by visiting a malicious webpage while logged in. The vulnerability allows modification of plugin settings without proper verification of the request origin.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into changing plugin settings or performing unintended actions via a malicious webpage.

Potential impact on your site

04Site Impact

An attacker can modify WP Meteor settings or trigger unwanted actions if your admin visits a malicious link while logged in.

Conditions required to exploit

05Prerequisites

Site admin must be logged in and visit an attacker-controlled webpage while the vulnerable plugin is active.

Key dates

06Disclosure timeline

November 13, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-63280 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager CVE-2026-65471 WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints CVE-2022-47150 WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability