Unauthorized Data Access and Modification Vulnerability in RapidLoad Web Vitals Automatically Plugin

CVE-2024-11840

Summary

The RapidLoad - Optimize Web Vitals Automatically plugin for WordPress presents a security risk due to a lack of capability checks on several critical functions such as uucss_data and update_rapidload_settings. This vulnerability affects all versions up to and including 2.4.2, enabling authenticated attackers with Subscriber-level access or higher to manipulate plugin settings and potentially execute SQL injection attacks. These security gaps could compromise the integrity and confidentiality of website data, highlighting the importance of timely updates and security assessments for users of the RapidLoad plugin.

References