CVE-2024-11840: RapidLoad – Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL ...
Description
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
Classification
CVE ID: CVE-2024-11840
CVSS Base Severity: HIGH
CVSS Base Score: 7.1
Affected Products
Vendor: shakee93
Product: RapidLoad – Optimize Web Vitals Automatically
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 20.6% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8ff4ec-9b40-4d59-b3b0-382f91042a4a?source=cvehttps://plugins.trac.wordpress.org/changeset/3202982/unusedcss