Fast Index <= 2.2 - Cross-Site Request Forgery to Arbitrary File Upload, Settings Update and Service Account Key Deletion
- ID
- WPSEC-2026-1122
- Plugin
- Fast Index for Google Indexing API (fast-index)
- Affected
- all versions before 3.0.0
- Remediation
- Update to 3.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- Fast Index on WPSec AttackSurface
- Fix released
- Published
Description
The Fast Index for Google Indexing API plugin for WordPress is vulnerable to Cross-Site Request Forgery via the settings page in all versions up to, and including, 2.2, due to missing nonce validation in the settingsPage() function, which saves settings, uploads service account files and deletes stored keys. The upload routine also defines ALLOW_UNFILTERED_UPLOADS and trusts the browser-supplied file type. This makes it possible for unauthenticated attackers to upload arbitrary files (including PHP files, which may allow remote code execution), change the plugin's settings, or delete stored Google service account keys via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1122/
- https://plugins.svn.wordpress.org/fast-index/tags/3.0.0/
- https://wordpress.org/plugins/fast-index/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS