RapidLoad WordPress Plugin Missing Authorization Vulnerability Allows Unauthorized Setting Resets

A vulnerability exists in the RapidLoad – Optimize Web Vitals Automatically plugin for WordPress, in all versions through 2.4.4. The issue arises from a missing capability check in the ajax_deactivate() function, allowing authenticated attackers with Subscriber-level access or higher to unauthorizedly modify data by resetting certain plugin settings.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin settings, which could disrupt the intended functionality of the plugin or the website's performance.

Remediation

Users can update to version 2.4.5 or a newer patched version to address this vulnerability.