The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API. This flaw allows authenticated users with Author-level access or higher to replace image files that are not owned by them, enabling them to modify content that they should not be able to alter.

The vulnerable product is the "Perfect Images" plugin for WordPress, developed by tigroumeow. All released versions up to and including 7.2.0 are affected; the issue is fixed in 7.2.1 and newer.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated WordPress account with Author-level or higher privileges, and is performed via the REST endpoint /wp-json/wp-retina-2x/v1/replace. Because only authenticated users can target the endpoint, the risk is confined to sites with user accounts but does not allow unauthenticated remote code execution.