The vulnerability is an insecure direct object reference in the Optimole WordPress plugin, caused by missing validation on a user‑controlled key used in the /wp-json/optml/v1/move_image REST API endpoint. This flaw allows any authenticated user with Author level access or higher to offload media that does not belong to them, exposing content from other users.

All installations of the Optimole – Optimize Images plugin for WordPress with version 4.1.0 or earlier are affected. The issue affects the plugin component that handles media offloading via its REST API. No newer version information is provided in the available data.

The CVSS score of 4.3 denotes moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in CISA KEV catalog. Exploitation requires an authenticated WordPress user with author or higher privileges accessing the move_image endpoint. Once the request contains a valid, but unauthorized, key, the attacker may trigger a transfer of an arbitrary media file owned by another user, leading to cross‑tenant data leakage or disruption of the target user’s content.