WordPress Plugin Vulnerabilities

ShortPixel Critical CSS < 1.0.3 - Missing Authorization

Description

The ShortPixel Critical CSS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several function sin versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions.

Affects Plugins

Plugin icon
shortpixel-critical-css
Fixed in 1.0.3

References

CVE
CVE-2024-32810
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4f0513-ac9c-4eaf-b3ce-3a7c47908ef7

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
ac7d5cdf-0be2-4f80-bb6a-e7de638757ba

Timeline

Publicly Published
2024-04-22 (about 2 years ago)
Added
2024-04-29 (about 2 years ago)
Last Updated
2024-04-29 (about 2 years ago)

Other

Published
Title
Published
2025-08-14
Title
WP Membership < 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Published
2026-03-02
Title
BigHearts < 3.1.15 - Missing Authorization
Published
2025-07-04
Title
fluXtore < 1.6.3 - Missing Authorization
Published
2026-01-16
Title
onepay Payment Gateway For WooCommerce < 1.1.3 - Missing Authorization to Unauthenticated Order Status Modification
Published
2025-06-05
Title
WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset