Is CVE-2026-11784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11784 being exploited in the wild.

How severe is CVE-2026-11784?

Medium severity, with a CVSS score of 4.3, published 18 June 2026.

Is there a fix for CVE-2026-11784?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11784 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11784?

Check whether you run Optimole at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11784: Optimole WordPress Plugin CSRF in replace_file function

CVE-2026-11784 · Severity: medium · CVSS 4.3 · Published 2026-06-18

The Optimole plugin for WordPress, which is used to optimize images and improve website performance, contains a security flaw that could allow an attacker to replace existing website images with their own content. To exploit this, an attacker must trick a site administrator or author into clicking a malicious link while they are logged in. This could lead to unauthorized content changes or website defacement.

Technologies: Optimole. Vendors: Optimole.

Quick answers

Is CVE-2026-11784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11784 being exploited in the wild.
How severe is CVE-2026-11784?: Medium severity, with a CVSS score of 4.3, published 18 June 2026.
Which products and versions are affected?: Optimole <= 4.2.6.
Is there a fix for CVE-2026-11784?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11784 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11784?: Check whether you run Optimole at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Optimole plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.6 due to missing or incorrect nonce validation on the replace_file function. An unauthenticated attacker can exploit this by tricking a user with 'Author' level privileges or higher into clicking a crafted link. Upon execution, the forged multipart POST request can overwrite existing media attachments that the victim has permission to edit. The vulnerability is mitigated by a 'current_user_can' check, which limits the impact to attachments the logged-in victim is authorized to modify.

Affected products

Optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6

Timeline

2026-06-18: disclosed
2026-06-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.