CVE-2021-24430 – This vulnerability in the Speed Booster Pack Wo... (How to Fix)

Q: What is the severity of CVE-2021-24430?

CVE-2021-24430 has a CVSS score of 7.2 (HIGH). This vulnerability in the Speed Booster Pack WordPress plugin allows remote code execution (RCE) due to improper input validation. Attackers can inject malicious PHP code through plugin settings, which gets written to a PHP file and executed. WordPress sites using vulnerable plugin versions are affected.

📋 TL;DR

This vulnerability in the Speed Booster Pack WordPress plugin allows remote code execution (RCE) due to improper input validation. Attackers can inject malicious PHP code through plugin settings, which gets written to a PHP file and executed. WordPress sites using vulnerable plugin versions are affected.

💻 Affected Systems

Products:

Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress Plugin

Versions: All versions before 4.2.0

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires plugin to be installed and active; no special configuration needed for exploitation.

📦 What is this software?

Speed Booster Pack by Optimocha

View all CVEs affecting Speed Booster Pack →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise allowing attackers to execute arbitrary code, install backdoors, steal data, deface websites, or pivot to internal networks.

🟠

Likely Case

Website defacement, data theft, malware installation, or cryptocurrency mining through compromised WordPress sites.

🟢

If Mitigated

No impact if plugin is patched or disabled; limited impact if proper web application firewalls and input validation are in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access to WordPress admin panel to modify plugin settings.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.2.0

Vendor Advisory: https://wordpress.org/plugins/speed-booster-pack/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Speed Booster Pack plugin. 4. Click 'Update Now' if available, or download version 4.2.0+ from WordPress repository. 5. Activate updated plugin.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily disable the Speed Booster Pack plugin until patched

wp plugin deactivate speed-booster-pack

Web Application Firewall rule

all

Block requests containing PHP code injection patterns in plugin settings

🧯 If You Can't Patch

Remove plugin entirely from WordPress installation
Restrict admin panel access to trusted IP addresses only

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Speed Booster Pack → Version number

Check Version:

wp plugin get speed-booster-pack --field=version

Verify Fix Applied:

Confirm plugin version is 4.2.0 or higher in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual PHP file creation/modification in plugin directories
Admin user modifying Speed Booster Pack settings unexpectedly
POST requests to wp-admin/admin.php with caching_exclude_urls parameter

Network Indicators:

HTTP requests containing PHP code in POST parameters
Unusual outbound connections from web server after plugin settings changes

SIEM Query:

source="wordpress.log" AND "caching_exclude_urls" AND ("eval(" OR "system(" OR "exec(")

📊 Metadata

CVE ID: CVE-2021-24430

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-94

Published: August 2, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-24430, you might also want to check these: