Vulnerabilities

TI-2024-25015 CVE-2024-37511 · GHSA-4w59-pwp7-whwv

WordPress Swift Performance Lite plugin <= 2.3.6.20 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in swte Swift Performance Lite swift-performance-lite allows Cross Site Request Forgery.This issue affects Swift Performance Lite: from n/a through <= 2.3.6.20.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.002 Published 2025-01-02 No fix listed CWE-352

TI-2024-09740 CVE-2024-10516 · GHSA-4wpm-wj3c-mr8r

Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'

MEDIUM 47

The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.06436 Published 2024-12-06 No fix listed CWE-22

TI-2024-03468 CVE-2024-3722 · GHSA-ggcw-7gr7-458r

Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification

LOW 25

The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00413 Published 2024-05-09 No fix listed CWE-863

Vulnerabilities

Filters

WordPress Swift Performance Lite plugin <= 2.3.6.20 - Cross Site Request Forgery (CSRF) vulnerability

Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'

Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification