CVE-2024-11851: NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update
Description
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
Classification
CVE ID: CVE-2024-11851
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: nitropack
Product: NitroPack – Caching & Speed Optimization for Core Web Vitals, Defer CSS & JS, Lazy load Images and CDN
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 16.25% (scored less or equal to compared to others)
EPSS Date: 2025-02-13 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=cvehttps://plugins.trac.wordpress.org/changeset/3211235/nitropack