Website administrators, developers, and tech-savvy individuals using WordPress should be aware of a recently discovered security flaw in the RapidLoad Power-Up for Autoptimize plugin. This vulnerability, identified as CVE-2023-1341, could allow unauthorized individuals to disable your website’s caching features without your permission.
CVE Details
Product: RapidLoad Power-Up for Autoptimize plugin for WordPress
Published Date: March 10, 2023
Severity: Medium
Status: Analyzed
Overview
The vulnerability stems from a weakness known as Cross-Site Request Forgery (CSRF). In simple terms, CSRF tricks a logged-in user into performing an action they didn’t intend. For the RapidLoad Power-Up for Autoptimize plugin, this specifically affects the ajax_deactivate function. This function lacked proper validation, meaning an attacker could craft a special link or request that, if clicked by an unsuspecting site administrator, would cause the plugin to turn off caching on the website. Disabling caching can significantly slow down your site and impact user experience.
Affected Products
This vulnerability impacts versions of the RapidLoad Power-Up for Autoptimize plugin for WordPress up to, and including, 1.7.1.
Current Status
The vulnerability has been analyzed and publicly disclosed. Developers of the RapidLoad Power-Up for Autoptimize plugin have addressed this issue by implementing proper nonce validation in the affected function. Nonce (number used once) validation is a security measure that helps prevent CSRF attacks by ensuring that requests come from legitimate sources.
Severity Level
The severity of CVE-2023-1341 is rated as Medium. While it doesn’t allow an attacker to directly inject malicious code or gain full control of your site, the ability to disable caching can degrade website performance and potentially lead to further attacks if not promptly addressed.
Possible Solutions
To protect your WordPress website from this Cross-Site Request Forgery vulnerability, it is crucial to update the RapidLoad Power-Up for Autoptimize plugin immediately. The fix involves adding nonce validation to the ajax_deactivate function. Therefore, users should update their plugin to version 1.7.2 or any subsequent version released by the developers that addresses this CVE. Always ensure your plugins are kept up-to-date to maintain optimal security.
References
https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/d95b01c3-5db4-40ac-8787-0db58a9cc3a6
