CVE-2023-1472: The RapidLoad Power-Up for Autoptimize plugin for WordPress ..

rapidload

Mar 17, 2023

Mar 23, 2023

Medium

6.3

/

10

Description

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.

Products affected:

  • rapidload» rapidload_power-up_for_autoptimize » *

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

Are your APIs vulnerable to this CWE?

In a few clicks Akto can analyze your API attack surface and see what APIs are vulnerable to OWASP Top 10 and other common CWEs.

Akto BG image
Akto BG image
Akto BG image

Severity

Medium

Medium

6.3

/

10

CVSS base metrics

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

User interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Exploitability Score

2.8

Impact Score

3.4

Weakness

CWE-352__CWE-352__

Explore more from Akto

Blog

Be updated about everything related to API Security, new API vulnerabilities, industry news and product updates.

Test Library

Discover and find tests from Akto's 100+ API Security test library. Choose your template or add a new template to start your API Security testing.

Documentation

Check out Akto's product documentation for all information related to features and how to use them.