Critical severity · published Oct 30, 2024
CVE-2024-8512
W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution
9.1
CVSS
1%
EPSS
No
On KEV
Description
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
W3
W3SPEEDSTER · w3speedster
through 7.26 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8512
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8512
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/w3speedster-wp/trunk/w3speedster.php#L740
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3175640/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/2a56eb63-ba5c-4452-8ab9-f5aeaf53adda?source=cve
More from W3SPEEDSTER
6.5
CVE-2024-52392
WordPress W3SPEEDSTER plugin <= 7.25 - Cross Site Request Forgery (CSRF) vulnerability
4.3
CVE-2025-23765
WordPress W3SPEEDSTER plugin <= 7.33 - Cross Site Request Forgery (CSRF) vulnerability
4.3
CVE-2024-24708
Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.19