Cross-Site Request Forgery in RapidLoad Power-Up for Autoptimize Plugin by WordPress

CVE-2023-1472

What is CVE-2023-1472?

The RapidLoad Power-Up for Autoptimize plugin for WordPress contains a vulnerability that exposes the plugin to Cross-Site Request Forgery (CSRF). This weakness arises from inadequate or incorrect nonce validation when handling AJAX requests. As a result, unauthenticated attackers can exploit this flaw to execute a range of functions by tricking an authorized admin into clicking on a malicious link. These functions may include resetting the API key, accessing or deleting log files, and compromise cache management, posing a significant security risk for affected sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References