CVE-2024-8512 - CVE House
Back to Database
Status published Critical CVE-2024-8512

W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code Execution

Vulnerability Description

The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8512

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lesor101

References

More from w3speedster

View All →
CVE-2025-23765
WordPress W3SPEEDSTER plugin <= 7.33 - Cross Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2024-52392
WordPress W3SPEEDSTER plugin <= 7.25 - Cross Site Request Forgery (CSRF) vulnerability
Medium 6.3

Affected Vendor

w3speedster

View all reports →

Affected Software

W3SPEEDSTER
Vulnerable Versions:
0

Timeline

Official Publish: October 30th, 2024
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.