CVE-2025-12015

Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect

View on CVE.org

Published Nov 13, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect Afosto

Analysis

Technical impact

The Convert WebP & AVIF – Quicq WordPress plugin contains a missing capability check on the "wpqai_disconnect_quicq_afosto" AJAX endpoint, allowing authenticated users with Subscriber-level access or higher to trigger an operation that disconnects the Afosto service. This flaw permits attackers to alter the plugin’s configuration and modify key data, potentially disrupting the integration with Afosto and undermining site functionality.

Affected Systems

All installations of the Convert WebP & AVIF – Quicq plugin for WordPress with versions up to and including 2.0.0 are affected. The vulnerability exists in every WordPress site that has this plugin installed, regardless of other configuration settings.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication; a user with at least Subscriber privileges can invoke the unsecured AJAX endpoint, but no elevated privileges or network-level access are necessary. The primary consequence is unauthorized modification of plugin configuration rather than a full system compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

sanderkah

Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.0.0

No data.

Vendor	Product	Versions
Sanderkah	Convert Webp & Avif	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the plugin to version 2.0.1 or later, or remove it if no longer needed.
Restrict Subscriber and lower user roles from accessing the plugin’s Ajax endpoints, or enforce stricter role permissions.
Audit the Afosto connection settings regularly and monitor for unexpected changes.

Generated by OpenCVE AI on April 22, 2026 at 21:12 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.213% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://wordpress.org/plugins/quicq/
https://www.wordfence.com/threat-intel/vulnerabilities/id/09f01dcc-685b-485b-8572-cdf73d0157dc?source=cve

History

Nov 13, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 13, 2025 4:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Sanderkah Sanderkah convert Webp & Avif Wordpress Wordpress wordpress
Vendors & Products		Sanderkah Sanderkah convert Webp & Avif Wordpress Wordpress wordpress

Nov 13, 2025 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Convert WebP & AVIF \| Quicq \| Best image optimizer and compression plugin \| Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect Afosto
Title		Convert WebP & AVIF \| Quicq \| Best image optimizer and compression plugin \| Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect
Weaknesses		CWE-862
References		https://wordpress.org/plugins/quicq/ https://www.wordfence.com/threat-intel/vulnerabilities/id/09f01dcc-685b-485b-8572-cdf73d0157dc?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`