Aruba HiSpeed Cache WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Aruba HiSpeed Cache plugin for WordPress, affecting all versions through 3.0.4. The vulnerability arises from a lack of nonce verification in the 'ahsc_ajax_reset_options()' function, allowing unauthenticated attackers to reset the plugin's settings to default by tricking an administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the plugin's settings, potentially disrupting the site's caching performance and management.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to the 'ahsc_ajax_reset_options' action without a valid nonce. This can be done by tricking an administrator into clicking a link that triggers the request, such as through a phishing email or a malicious website.

Remediation

Users are advised to update the Aruba HiSpeed Cache plugin to version 3.0.5 or later.