CVE-2024-11851
NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
| CWE | CWE-862 |
| Vendor | nitropack |
| Product | nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimization |
| Published | Jan 15, 2025 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for nitropack nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimization
Be the first to know when new medium vulnerabilities affecting nitropack nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimization are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
nitropack / NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization
0 ≤ 1.17.0
References
Credits
Sean Murphy