What is CVE-2023-1924?

CVE-2023-1924 is a medium-severity vulnerability in the WP Fastest Cache plugin for WordPress, affecting versions up to and including 1.1.2. This vulnerability is due to missing or incorrect nonce validation, leading to Cross-Site Request Forgery (CSRF) attacks. Unauthenticated attackers can potentially change cache settings via a forged request if they trick a site administrator into performing an action, such as clicking on a link. The affected systems are WordPress websites using the vulnerable versions of the WP Fastest Cache plugin.

Who is impacted by this?

CVE-2023-1924 affects users of the WP Fastest Cache plugin for WordPress, specifically those using versions up to and including 1.1.2. This issue allows unauthenticated attackers to potentially change cache settings via a forged request if they trick a site administrator into performing an action, such as clicking on a link. The affected systems are WordPress websites using the vulnerable versions of the WP Fastest Cache plugin.

What to do if CVE-2023-1924 affected you

If you're affected by the CVE-2023-1924 vulnerability, it's crucial to take action to secure your WordPress site. Follow these simple steps to mitigate the risk:

1. Update the WP Fastest Cache plugin to version 1.1.3 or a newer patched version.

2. Regularly update all plugins and themes on your WordPress site.

3. Educate site administrators about the risks of clicking on suspicious links.

Is thisin CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1924 vulnerability in the WP Fastest Cache plugin for WordPress is not listed in CISA's Known Exploited Vulnerabilities Catalog. To address this medium-severity issue, users should update the plugin to version 1.1.3 or a newer patched version, which mitigates the risk of Cross-Site Request Forgery attacks.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-352, which is a Cross-Site Request Forgery issue in the WP Fastest Cache plugin for WordPress.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• Wordfence Intelligence

• CVE Record