Executive brief
The Optimole plugin for WordPress, which is used to optimize images and improve website performance, contains a security flaw that could allow an attacker to replace existing website images with their own content. To exploit this, an attacker must trick a site administrator or author into clicking a malicious link while they are logged in. This could lead to unauthorized content changes or website defacement.
Technical details
The Optimole plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.6 due to missing or incorrect nonce validation on the replace_file function. An unauthenticated attacker can exploit this by tricking a user with 'Author' level privileges or higher into clicking a crafted link. Upon execution, the forged multipart POST request can overwrite existing media attachments that the victim has permission to edit. The vulnerability is mitigated by a 'current_user_can' check, which limits the impact to attachments the logged-in victim is authorized to modify.
Affected products
- Optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574315%40optimole-wp&new=3574315%40optimole-wp&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad?source=cve