CVE-2024-5810: WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-09 · updated 2026-06-17
Weakness: CWE-798

Description

The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.

Affected products

Wp2Speed: through 1.0.1

References

https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71
https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71
https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve

Get alerted when CVE-2024-5810 or the next vulnerability affects your stack