CVE-2021-24430

Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE

State: Published
Severity: Not scored
Published: Aug 2, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE

Scores

The record has no CVSS score.

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Speed Booster Pack ⚡ PageSpeed Optimization SuiteUnknown	4.2.0-beta to before 4.2.0-beta*Affected 4.2.0 to before 4.2.0Affected

References

https://wpscan.com/vulnerability/945d6d2e-fa25-42c0-a7b4-b1794732a0df
https://m0ze.ru/vulnerability/%5B2021-05-10%5D-%5BWordPress%5D-%5BCWE-94%5D-Speed-Booster-Pack-WordPress-Plugin-v4.2.0-beta.txt

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.