Image Optimizer CVE-2026-90953

Exploitation requires an authenticated WordPress account of any privilege level (PR:L) on a site running Image Optimizer before 1.7.7 - the flaw is that several read REST routes omit the intended administrator-only capability check, so a logged-in non-admin can invoke them. The primary limiting factor is that valid authentication is required (no unauthenticated access), which in practice depends on whether the site permits low-privilege registrations or the attacker otherwise obtains an account; no user interaction by a victim is needed and attack complexity is low. Impact is bounded to reading attachment metadata and site-wide statistics - confidentiality only, with no ability to modify data or affect availability.

This is a low-severity, real-but-minor issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect. All three CISA SSVC signals reinforce a low-urgency reading: Exploitation is 'none' (no observed activity), Automatable is 'no', and Technical Impact is only 'partial'. There is no CISA KEV listing and no public exploit code identified, so exploitation status is 'no public exploit identified at time of analysis'. EPSS is not provided in the input, so exploitation probability cannot be quantified here. The signals are internally consistent - a broken-access-control information-disclosure bug that leaks admin-scoped read data (attachment metadata and site-wide statistics) to any logged-in user. The practical ceiling is low: an attacker must already hold a valid (even low-privilege, e.g. subscriber) account, and the reward is metadata/statistics rather than credentials or content modification. This is a genuine authorization defect worth patching but not a high-real-risk item.

An attacker who holds any authenticated WordPress account on a site running Image Optimizer < 1.7.7 (for example a self-registered subscriber on a site with open registration) directly calls the plugin's read REST routes, which fail to enforce the intended administrator capability check. This returns attachment metadata and site-wide optimization statistics that should be restricted to administrators. No public proof-of-concept is identified, and low attack complexity means the requests are straightforward once a valid session/nonce is obtained.