Beta

Report

Swift Performance Lite <= 2.3.6.14 is vulnerable to Missing Authorization to Unauthenticated Settings Export vulnerability

Unauthenticated
Published
2023-11-27

The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admin_init function in all versions up to, and including, 2.3.6.14. This makes it possible for unauthenticated attackers to export the settings of the plugin which can contain Cloudflare API tokens.

CVSS

Score:5.3

Severity:Medium

Version: 2.3.6.14

There is a patch available in v2.3.6.15 and we strongly recommend you update to this version as soon as possible.