Perfect Images
Monthly
Missing capability checks in the Perfect Images WordPress plugin (wp-retina-2x) through version 7.2.0 allow any authenticated user holding Author-level access to replace media files that do not belong to them via the /wp-json/wp-retina-2x/v1/replace REST route. Exploitation requires a valid account at Author level or above on a site where the plugin is installed and active; no user interaction and no non-default configuration are needed. Impact is confined to integrity (CVSS 3.1 score 4.3, C:N/I:L/A:N), with no confidentiality or availability effect described in the available sources; no public exploit has been identified at time of analysis, and no CISA KEV entry was supplied.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).4.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 12.9%.
Missing capability checks in the Perfect Images WordPress plugin (wp-retina-2x) through version 7.2.0 allow any authenticated user holding Author-level access to replace media files that do not belong to them via the /wp-json/wp-retina-2x/v1/replace REST route. Exploitation requires a valid account at Author level or above on a site where the plugin is installed and active; no user interaction and no non-default configuration are needed. Impact is confined to integrity (CVSS 3.1 score 4.3, C:N/I:L/A:N), with no confidentiality or availability effect described in the available sources; no public exploit has been identified at time of analysis, and no CISA KEV entry was supplied.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).4.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 12.9%.