CVE-2023-6598: SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update
The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycachesavevarniship, speedycacheimgupdatesettings, speedycachepreloadingaddsettings, and speedycachepreloadingdeleteresource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6598?
CVE-2023-6598 is classified as a medium severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2023-6598?
To fix CVE-2023-6598, update the SpeedyCache plugin to its latest version where the capability checks have been implemented.
What functions are affected by CVE-2023-6598?
The functions affected by CVE-2023-6598 include speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource.
Who is affected by CVE-2023-6598?
CVE-2023-6598 affects all versions of the SpeedyCache plugin for WordPress up to version 1.1.3.
What type of attack can CVE-2023-6598 enable?
CVE-2023-6598 can enable attackers to modify data without authorization due to the missing capability checks.