CVE-2023-1472

Published on: Not Yet Published

Last Modified on: 03/17/2023 03:44:00 PM UTC

CVE-2023-1472

Certain versions of RapidLoad Power-Up For Autoptimize from Shakee93 contain the following vulnerability:

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.

CVE-2023-1472 has been assigned by [email protected] to track the vulnerability
Affected Vendor/Software: shakee93 - RapidLoad Power-Up for Autoptimize version <= 1.7.1

CVE References

Description	Tags ^ⓘ	Link
RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery	www.wordfence.com text/html	MISC www.wordfence.com/threat-intel/vulnerabilities/id/8f9ee168-82b1-4d13-a84e-379f16dcb283?source=cve
403 Forbidden	plugins.trac.wordpress.org text/html Inactive LinkNot Archived	MISC plugins.trac.wordpress.org/browser/unusedcss/tags/1.7.1/includes/modules/unused-css/UnusedCSS_Admin.php#L70

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Software

Vendor	Product	Version
Shakee93	RapidLoad_Power-Up_for_Autoptimize	<= 1.7.1

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2023-1472 : The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request For… twitter.com/i/web/status/1…	2023-03-17 15:04:24
@Robo_Alerts	Potentially Critical CVE Detected! CVE-2023-1472 The RapidLoad Power-Up for Autoptimize plugin for WordPress is vul… twitter.com/i/web/status/1…	2023-03-17 15:56:01
/r/netcve	CVE-2023-1472	2023-03-17 16:38:21