CVE-2024-5810 - Vulnerability Details - OpenCVE

The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00432.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Wp2speed	Wp2speed

No data.

No data.

No data.

References

Link	Providers
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372
https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71
https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve

History

Wed, 08 Apr 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-798

Fri, 27 Feb 2026 05:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wp2speed Wp2speed wp2speed
CPEs		cpe:2.3:a:wp2speed:wp2speed::::::::
Vendors & Products		Wp2speed Wp2speed wp2speed
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-07-09T08:33:03.671Z

Updated: 2026-04-08T16:41:07.760Z

Reserved: 2024-06-10T19:17:36.398Z

Link: CVE-2024-5810

Vulnrichment

Updated: 2024-08-01T21:25:02.726Z

NVD

Status : Awaiting Analysis

Published: 2024-07-09T09:15:07.883

Modified: 2026-04-08T17:19:06.873

Link: CVE-2024-5810

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-5810", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-06-10T19:17:36.398Z", "datePublished": "2024-07-09T08:33:03.671Z", "dateUpdated": "2026-04-08T16:41:07.760Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:07.760Z"}, "affected": [{"vendor": "wp2speed", "product": "WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments."}], "title": "WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-798 Use of Hard-coded Credentials", "cweId": "CWE-798", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "timeline": [{"time": "2024-07-08T19:47:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"affected": [{"vendor": "wp2speed", "product": "wp2speed", "cpes": ["cpe:2.3:a:wp2speed:wp2speed:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-09T14:24:50.791970Z", "id": "CVE-2024-5810", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T16:30:44.152Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:02.726Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152", "tags": ["x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:02.726Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5810", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-09T14:24:50.791970Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wp2speed:wp2speed:*:*:*:*:*:*:*:*"], "vendor": "wp2speed", "product": "wp2speed", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-09T14:28:39.408Z"}}], "cna": {"title": "WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials", "credits": [{"lang": "en", "type": "finder", "value": "Lucio S\u00e1"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wp2speed", "product": "WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-07-08T19:47:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152"}, {"url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165"}], "descriptions": [{"lang": "en", "value": "The WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:07.760Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5810", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:07.760Z", "dateReserved": "2024-06-10T19:17:36.398Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2024-07-09T08:33:03.671Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments."}, {"lang": "es", "value": " El complemento WP2Speed Faster \u2013 Optimize PageSpeed Insights Score 90-100 para WordPress es vulnerable al acceso no autorizado en todas las versiones hasta la 1.0.1 incluida. Esto se debe al uso de credenciales codificadas para autenticar todas las solicitudes API entrantes. Esto hace posible que atacantes no autenticados sobrescriban CSS, actualicen la configuraci\u00f3n de prueba, purguen el cach\u00e9 y encuentren archivos adjuntos."}], "id": "CVE-2024-5810", "lastModified": "2026-04-08T17:19:06.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2024-07-09T09:15:07.883", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L372"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L71"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe97ac1-cab9-4b6f-bddd-bdcdc9faee40?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "security@wordfence.com", "type": "Primary"}]}