Image Optimizer vulnerabilities

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contain an OS command injection vulnerability in ImageOptimizer#identify_format. Attackers controlling the image path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.

The Image Optimizer plugin for WordPress versions up to 1.7.4 is vulnerable to arbitrary file deletion due to insufficient path validation in the Image_Backup::remove() function. Backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. An authenticated attacker with Author-level access can inject arbitrary absolute file paths into the backups array via the Custom Fields interface, leading to file deletion when the attachment is deleted.