CVE-2024-5810 identifies a vulnerability in the WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 WordPress plugin where hardcoded credentials are used to authenticate all incoming API requests. This design flaw enables unauthenticated attackers to bypass authentication controls and execute unauthorized operations including modifying CSS files, changing trial settings, clearing cached data, and enumerating attachments. The vulnerability affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting integrity but not confidentiality or availability.

The vulnerability allows unauthenticated remote attackers to perform unauthorized modifications to the plugin's configuration and content, including overwriting CSS, updating trial settings, purging cache, and accessing attachments. This could lead to website content manipulation and potential disruption of plugin functionality. There is no indication of impact on confidentiality or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should consider disabling the plugin or restricting access to the affected API endpoints until a fix is released. Monitor the vendor's communications for updates on remediation.