WordPress Plugin Vulnerabilities

WPSpeed < 2.6.6 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
wpspeed
Fixed in 2.6.6

References

CVE
CVE-2025-47590
URL
https://patchstack.com/database/wordpress/plugin/wpspeed/vulnerability/wordpress-wpspeed-2-6-5-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
No
WPVDB ID
9637efd7-7c2c-48c2-9d9a-c4bda9a54bef

Timeline

Publicly Published
2025-05-07 (about 1 year ago)
Added
2025-05-13 (about 1 year ago)
Last Updated
2025-06-30 (about 1 year ago)

Other

Published
Title
Published
2023-10-16
Title
Ultimate Taxonomy Manager <= 2.0 - Arbitrary Settings Update via CSRF
Published
2023-02-20
Title
CSS JS Manager < 2.4.49.1 - Multiple CSRF
Published
2023-03-16
Title
Bulk Resize Media <= 1.1 - CSRF
Published
2022-04-28
Title
Hermit <= 3.1.6 - Stored Cross-Site Scripting via CSRF
Published
2021-09-13
Title
Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF