The Image Optimizer by wps.sk plugin is vulnerable to Cross‑Site Request Forgery due to missing or incorrect nonce validation in the imagopby_ajax_optimize_gallery() function. An attacker who can trick a site administrator into clicking a forged link can trigger automatic bulk image optimization, consuming server resources and potentially degrading site performance. This effect can lead to a denial‑of‑service scenario for media‑heavy sites.

The vulnerability affects all releases of the Image Optimizer by wps.sk WordPress plugin up to and including version 1.2.0. WordPress sites that have installed that plugin version are at risk.

The CVSS score of 4.3 indicates a low‑to‑moderate severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must lure an administrator to a forged request, so the vector relies on social engineering, but the lack of nonce validation provides a reliable path for attackers who succeed in tricking an admin.