CVE-2024-11851

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-11851", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2024-11-26T21:18:43.921Z", "datePublished": "2025-01-15T11:29:52.770Z", "dateUpdated": "2026-04-08T17:05:26.026Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:26.026Z"}, "affected": [{"vendor": "nitropack", "product": "NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.17.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values."}], "title": "NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3211235/nitropack"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sean Murphy"}], "timeline": [{"time": "2024-11-27T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-01-14T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-15T14:33:40.839966Z", "id": "CVE-2024-11851", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T14:33:45.465Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-11851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-15T14:33:40.839966Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-15T14:33:39.400Z"}}], "cna": {"title": "NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update", "credits": [{"lang": "en", "type": "finder", "value": "Sean Murphy"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "nitropack", "product": "NitroPack \u2013 Caching & Speed Optimization for Core Web Vitals, Defer CSS & JS, Lazy load Images and CDN", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.17.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-11-27T00:00:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-01-14T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3211235/nitropack"}], "descriptions": [{"lang": "en", "value": "The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-01-15T11:29:52.770Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11851", "state": "PUBLISHED", "dateUpdated": "2025-01-15T14:33:45.465Z", "dateReserved": "2024-11-26T21:18:43.921Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-01-15T11:29:52.770Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "NitroPack \u2013 Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization", "vendor": "nitropack", "versions": [{"lessThanOrEqual": "1.17.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values."}, {"lang": "es", "value": "El complemento NitroPack para WordPress es vulnerable a actualizaciones transitorias arbitrarias no autorizadas debido a una verificaci\u00f3n de capacidad faltante en la funci\u00f3n nitropack_rml_notification en todas las versiones hasta la 1.17.0 incluida. Esto hace posible que atacantes autenticados, con acceso de suscriptor o superior, actualicen valores transitorios arbitrarios. Tenga en cuenta que estos valores transitorios solo se pueden actualizar a n\u00fameros enteros y no a valores arbitrarios."}], "id": "CVE-2024-11851", "lastModified": "2026-06-17T06:58:35.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-11851", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-15T14:33:40.839966Z", "version": "2.0.3"}}]}, "published": "2025-01-15T12:15:25.630", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3211235/nitropack"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8945bae7-2224-4d9f-b693-10c94c94dea0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"created": "2025-07-13T21:07:18.224942+00:00", "updated": "2025-07-13T21:07:18.224999+00:00", "vendors": ["nitropack", "nitropack$PRODUCT$nitropack", "wordpress", "wordpress$PRODUCT$wordpress"]}