Seraphinite Accelerator WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Seraphinite Accelerator plugin for WordPress, affecting all versions through 2.27.21. The vulnerability arises from inadequate nonce validation in the 'OnAdminApi_CacheOpBegin' function, allowing unauthenticated attackers to impersonate site administrators and execute various administrative tasks, such as cache deletion, by tricking them into clicking a link.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative actions being performed on behalf of a site administrator, including cache deletion.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to the 'OnAdminApi_CacheOpBegin' endpoint, including a nonce that has not been properly validated. This can be done by tricking an administrator into clicking a link that triggers the request, such as through a phishing email or a malicious website.

Remediation

Users are advised to update the Seraphinite Accelerator plugin to version 2.27.22 or later.