The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_start_cdn_integration_ajax_request_callback function. This makes it possible for unauthenticated attackers to change cdn settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
Configurations
History
07 Nov 2023, 04:05
Type | Values Removed | Values Added |
---|---|---|
CWE |
12 Apr 2023, 23:28
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:* | |
First Time |
Wpfastestcache
Wpfastestcache wp Fastest Cache |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/17c7c61d-c110-448e-ad8a-bc1c00393524?source=cve - Third Party Advisory | |
References | (MISC) https://plugins.trac.wordpress.org/changeset/2893158/wp-fastest-cache/trunk/wpFastestCache.php?contextall=1 - Patch |
07 Apr 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
Summary | The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfc_start_cdn_integration_ajax_request_callback function. This makes it possible for unauthenticated attackers to change cdn settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
References |
|
|
06 Apr 2023, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-04-06 20:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-1921
Mitre link : CVE-2023-1921
CVE.ORG link : CVE-2023-1921
JSON object : View
Products Affected
wpfastestcache
- wp_fastest_cache
CWE
No CWE.