10Web Booster – Website speed optimization, Cache & Page Speed optimizer, a5844136834f85b2f395ec698651bb0c6473b351
- CVE, Research URL
- Home page URL
- Published on
- Oct 29, 2023
- Research Description
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer [tenweb-speed-optimizer] < 2.24.18 10Web Booster <= 2.24.14 - Unauthenticated Arbitrary Option Deletion The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the option value being supplied to the two_init_flow_score and the two_init_flow_score functions hooked via nopriv AJAX in all versions up to, and including, 2.24.14. This makes it possible for unauthenticated attackers to delete arbitrary option values from the site.
- Affected versions
-
max 2.24.18.
- Status
-
vulnerable