CVE-2026-90953
MediumCVSS 4.3Summary
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
Risk Assessment
Exposure of sensitive information (attachment metadata, statistics) to unauthorized users, potentially compromising privacy and site security.
Recommendation
Update the Image Optimizer plugin to version 1.7.7 or later to restore proper access control.
Other vulnerabilities in Image Optimizer
See all- CVE-2026-107704Critical
The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contain an OS command injection vulnerability in ImageOptimizer#identify_format. Attackers controlling the image path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
- CVE-2026-5821High
The Image Optimizer plugin for WordPress versions up to 1.7.4 is vulnerable to arbitrary file deletion due to insufficient path validation in the Image_Backup::remove() function. Backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. An authenticated attacker with Author-level access can inject arbitrary absolute file paths into the backups array via the Custom Fields interface, leading to file deletion when the attachment is deleted.
Original NVD description (English source)
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS