WP Meteor Page Speed Optimization Topping <= 3.1.4 -Missing Authorization to Notice Dismissal
2023-03-03 00:00
AnonymousStrategic Overview
StatusPatched in 3.1.5
Affected PluginWP Meteor Website Speed Optimization Addon
Affected Version
<= 3.1.4CVSS4.3Medium
CVE
N/AVulnerability Overview
The WP Meteor Page Speed Optimization Topping plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the processAjaxNoticeDismiss function in versions up to, and including, 3.1.4. This makes it possible for authenticated attackers with subscriber level access to dismiss administrative notices.
Technical Analysis
REMEDIATION: Update to version 3.1.5, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C