A security flaw has been identified in the RapidLoad Power-Up for Autoptimize plugin, a popular tool for WordPress websites. This vulnerability, tracked as CVE-2023-1335, could allow unauthorized individuals with even low-level access to your website to change certain plugin settings. This post explains the issue and what you can do to protect your site.
CVE Details
The vulnerability affects the RapidLoad Power-Up for Autoptimize plugin for WordPress.
- CVE ID: CVE-2023-1335
- Published Date: March 10, 2023
- Severity: Medium
- Status: Analyzed
Affected Products
The security flaw is present in the RapidLoad Power-Up for Autoptimize plugin for WordPress, specifically in all versions up to and including 1.7.1. If you are running version 1.7.1 or older, your website is at risk.
Current Status
This vulnerability has been thoroughly analyzed. The details of the flaw are public, which means it’s crucial for website administrators to take immediate action to secure their installations.
Severity Level
Rated as ‘Medium’ severity, this vulnerability allows an authenticated attacker, even with a basic subscriber-level account, to connect a new license key to your website. While this doesn’t immediately grant full control, it represents an unauthorized modification of critical plugin settings, potentially disrupting services or enabling further malicious activities if exploited creatively. The risk is significant because subscriber accounts are common and typically have very limited privileges.
Possible Solutions
The good news is that a fix for this vulnerability has been implemented. The core issue stemmed from a missing capability check in the ucss_connect function, which has since been addressed by adding a nonce check to verify the legitimacy of requests.
To protect your WordPress website, you must update your RapidLoad Power-Up for Autoptimize plugin to a version **greater than 1.7.1**. It is always recommended to keep all your plugins and themes updated to their latest versions to ensure you have the most recent security patches.
Before performing any updates, always:
- Backup your entire WordPress site.
- Test the update on a staging environment first, if possible.
References
https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/eba48c51-87d9-4e7e-b4c1-0205cd96d033
