What’s Vulnerable › Vulnerabilities

CVE-2024-11851: NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-15 · updated 2026-06-17
• Weakness: CWE-862

Description

The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.

Affected products

• NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization: through 1.17.0

References

• https://plugins.trac.wordpress.org/changeset/3211235/nitropack
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=cve

Get alerted when CVE-2024-11851 or the next vulnerability affects your stack