Unauthorized Arbitrary Transient Update in NitroPack Plugin for WordPress

CVE-2024-11851

Summary

The NitroPack plugin for WordPress contains a security flaw that allows authenticated attackers, with subscriber permissions or higher, to perform unauthorized arbitrary updates to transient data via the nitropack_rml_notification function. This vulnerability arises from a lack of capability checks, which exposes the system to potential risks. It should be noted that the updates can only be made to integer values, which may limit the scope of potential exploits but still poses a significant security concern for WordPress sites using this plugin.

References