CVE-2024-11840: 
WordPress vulnerability analysis and mitigation

The RapidLoad – Optimize Web Vitals Automatically WordPress plugin contains a missing authorization vulnerability (CVE-2024-11840) affecting all versions up to and including 2.4.2. The vulnerability was disclosed on December 11, 2024, and impacts the plugin's capability checks on multiple functions (NVD).

The vulnerability stems from missing capability checks on multiple plugin functions including uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating network accessibility with low attack complexity (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to modify plugin settings and potentially conduct SQL injection attacks. This could lead to unauthorized access to data and modification of plugin configurations (NVD).

Users should update to version 2.4.3 or later of the RapidLoad plugin which contains fixes for these security issues (WordPress Plugin Repository).