Perfect Images CVE-2025-11455

Requires a valid authenticated account with Author-level capabilities or higher on a WordPress site that has Perfect Images (wp-retina-2x) version 7.2.0 or earlier installed and active; the vulnerable /wp-json/wp-retina-2x/v1/replace REST route performs no capability check. Limiting factors: exploitation is gated on holding the Author role (PR:L), a trust level normally granted only to semi-trusted contributors, so sites that do not provision Author accounts to untrusted parties face substantially reduced exposure. No user interaction is needed and no non-default configuration is required beyond the plugin being installed. Impact is limited to integrity (replacing files belonging to other users); the sources do not state that it enables confidentiality or availability loss.

This is a moderate-severity, access-control flaw (CWE-862, missing capability check) with a provided CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). The signals are internally consistent and point to a limited-impact issue rather than a top priority: network vector and low complexity are offset by the requirement for an authenticated account with at least Author-level privileges (PR:L), and the impact is confined to integrity (I:L), with no confidentiality or availability effect. No EPSS score was provided, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. No public exploit code was supplied - the only references are the Wordfence advisory and the WordPress plugin SVN changeset showing the fix. The vuln.today priority 'this_month' aligns with a patch-on-normal-cadence posture rather than an emergency. Net assessment: a real but bounded issue whose exploitation depends on an attacker already holding a trusted (Author+) role, which materially limits real-world risk on well-administered sites. Missing data: EPSS probability and any independent exploitation telemetry are absent.

An attacker who already holds an Author-level (or higher) account on a WordPress site running Perfect Images ≤7.2.0 - for example via a compromised contributor credential or an open multi-author blog - sends a request to the /wp-json/wp-retina-2x/v1/replace REST endpoint. Because the endpoint lacks a capability check, the attacker can replace media/files that belong to other users, tampering with site content. No public exploit code was identified at time of analysis; the attack requires authentication at the Author trust level.