CVE-2024-13438 Overview
CVE-2024-13438 is a Cross-Site Request Forgery (CSRF) vulnerability in the SpeedSize Image & Video AI-Optimizer plugin for WordPress. The flaw affects all versions up to and including 1.5.1. It stems from missing or incorrect nonce validation on the speedsize_clear_css_cache_action function. Unauthenticated attackers can trigger cache-clearing operations by tricking an authenticated administrator into clicking a crafted link or visiting an attacker-controlled page. The issue is tracked under CWE-352.
Critical Impact
An unauthenticated attacker can clear the plugin's CSS cache by coercing a logged-in administrator into visiting a malicious page, potentially degrading site performance until the cache regenerates.
Affected Products
- SpeedSize Image & Video AI-Optimizer for WordPress (all versions)
- Versions through and including 1.5.1
- WordPress sites running the vulnerable plugin with authenticated administrators
Discovery Timeline
- 2025-02-18 - CVE-2024-13438 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13438
Vulnerability Analysis
The vulnerability resides in the speedsize_clear_css_cache_action handler exposed by the SpeedSize plugin. WordPress plugins typically protect state-changing actions with nonces generated via wp_create_nonce() and verified through check_admin_referer() or wp_verify_nonce(). In vulnerable versions of SpeedSize, this validation is either absent or implemented incorrectly on the cache-clearing endpoint.
As a result, a request originating from an unrelated origin can invoke the action as long as the victim's browser carries a valid authenticated session cookie for the target WordPress site. The impact is limited to integrity of the plugin's CSS cache; no confidentiality or availability compromise of the underlying host is reported.
Root Cause
The root cause is missing CSRF protection on a privileged administrative action. The handler processes requests without confirming that they were issued from a legitimate WordPress admin UI. This design gap violates the principle that any state-changing HTTP request must include and validate an anti-CSRF token bound to the user session.
Attack Vector
Exploitation requires user interaction from a WordPress administrator. An attacker crafts a webpage, email, or forum post containing a hidden request (for example, an image tag, form auto-submit, or link) targeting the vulnerable endpoint. When the administrator, already authenticated to the WordPress site, loads the attacker's content, the browser transmits session cookies alongside the forged request. The server processes the cache-clear action as if the administrator initiated it.
No verified public proof-of-concept has been published. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2024-13438
Indicators of Compromise
- Unexpected entries in web server access logs showing requests to the speedsize_clear_css_cache_action endpoint with an external Referer header.
- Sudden or repeated CSS cache regeneration events in the SpeedSize plugin logs without corresponding administrator activity in the WordPress dashboard.
- Administrator sessions loading external content immediately preceding cache-clear events.
Detection Strategies
- Review web application firewall (WAF) logs for POST or GET requests to WordPress admin-ajax or admin-post endpoints invoking speedsize_clear_css_cache_action without a valid nonce parameter.
- Correlate HTTP Referer headers on cache-clear requests against the site's own domain; off-site referers indicate potential CSRF activity.
- Enable WordPress audit logging to record all administrator-triggered plugin actions and compare against expected admin behavior.
Monitoring Recommendations
- Monitor for anomalous frequency of cache-clear operations tied to a single administrator session.
- Alert on cross-origin requests targeting WordPress admin endpoints, particularly from unfamiliar domains.
- Track plugin version inventory across managed WordPress sites to identify hosts still running SpeedSize 1.5.1 or earlier.
How to Mitigate CVE-2024-13438
Immediate Actions Required
- Update the SpeedSize Image & Video AI-Optimizer plugin to a version newer than 1.5.1 as published on the WordPress plugin repository.
- Instruct WordPress administrators to log out of admin sessions when not actively managing the site.
- Deploy a WAF rule to block requests to the vulnerable action lacking a valid WordPress nonce parameter.
Patch Information
The vendor addressed the vulnerability in a plugin update published through the WordPress plugin repository. Review the WordPress Plugin Change Log for the exact revision that introduced nonce validation on the speedsize_clear_css_cache_action handler and upgrade all affected installations.
Workarounds
- Temporarily deactivate the SpeedSize plugin until administrators can apply the patched release.
- Restrict access to the WordPress /wp-admin/ path by IP allowlist so that CSRF payloads served from external sites cannot reach the vulnerable endpoint.
- Use browser session isolation for WordPress administrators, keeping admin browsing separate from general web activity to reduce CSRF exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
