CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.
Explanation of Vulnerability in Simple Terms
WP2Speed Faster versions up to 1.0.1 contain a hardcoded credential vulnerability that allows unauthenticated attackers to modify site data over the network. The plugin stores sensitive authentication information in its code, enabling unauthorized access without requiring user interaction. Site administrators should update immediately to a patched version.
What an attacker can do
Modify site data without authentication by exploiting hardcoded credentials in the plugin.
Potential impact on your site
Attackers can alter site content, settings, or data without logging in, potentially defacing or compromising your site.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
