Cross-Site Request Forgery in RapidLoad Power-Up for Autoptimize Plugin by WordPress

CVE-2023-1472

Summary

The RapidLoad Power-Up for Autoptimize plugin for WordPress contains a vulnerability that exposes the plugin to Cross-Site Request Forgery (CSRF). This weakness arises from inadequate or incorrect nonce validation when handling AJAX requests. As a result, unauthenticated attackers can exploit this flaw to execute a range of functions by tricking an authorized admin into clicking on a malicious link. These functions may include resetting the API key, accessing or deleting log files, and compromise cache management, posing a significant security risk for affected sites.

References