EUVD-2026-37848
GHSA-xh6r-5wcf-38f6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker needs no privileges (PR:N); victim interaction required (UI:R); impact limited to partial integrity of media files only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Optimole - Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
AnalysisAI
Cross-Site Request Forgery in the Optimole WordPress plugin (all versions through 4.2.6) allows unauthenticated remote attackers to overwrite existing media attachment files by forging multipart POST requests targeting the replace_file function, provided the attacker can socially engineer a WordPress user with at least Author-level access into clicking a crafted link. The missing nonce validation in the attachment_edit.php handler means the server cannot distinguish legitimate requests from forged ones, enabling arbitrary content injection into any attachment the victim can edit. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the Wordfence disclosure provides full technical detail including source line references, lowering the bar for weaponization.
Technical ContextAI
The vulnerability resides in the replace_file function within inc/media_rename/attachment_edit.php of the Optimole plugin (CPE: cpe:2.3:a:optimole:optimole_-_optimize_images_|_convert_webp_&_avif_|_cdn_&_lazy_load_|_image_optimization:*:*:*:*:*:*:*:*). Optimole is a WordPress image optimization plugin that handles WebP/AVIF conversion, CDN delivery, and lazy loading. The root cause is CWE-352 (Cross-Site Request Forgery): WordPress nonces are either absent or improperly validated before the replace_file handler processes a multipart POST, meaning a browser will automatically attach the victim's authentication cookies to any cross-origin POST crafted by an attacker. The handler does enforce a current_user_can('edit_post', $id) check (visible at attachment_edit.php L24 and L331 in both tag 4.2.5 and 4.2.6), which confirms the server enforces WordPress capability checks after authentication - but this check is bypassed in practice because the CSRF allows the forged request to ride the victim's session. The affected code paths are publicly browsable in the WordPress SVN repository, making the vulnerable logic fully disclosed.
RemediationAI
A fix has been committed to the Optimole plugin SVN repository (changeset 3574315, visible at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574315%40optimole-wp&new=3574315%40optimole-wp); however, the specific patched release version number is not confirmed from the available data - administrators should update to the latest available version in the WordPress plugin repository and verify the installed version is newer than 4.2.6. As an interim workaround, if the plugin's media rename or attachment replacement feature is not operationally required, disabling the plugin entirely or restricting Author-level user roles from managing media can reduce the attack surface. Restricting who can hold Author or higher privileges on the WordPress installation limits the pool of viable CSRF victims. Note that disabling Author-level posting would affect normal site workflows. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad should be monitored for a confirmed patched version number.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today