The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress contains a missing capability check on its REST endpoint /webp-converter/v1/regenerate-attachment. This flaw allows any authenticated user with Subscriber-level access or higher to delete the optimized WebP or AVIF versions of any attachment, effectively removing the performance benefits of the plugin. The weakness aligns with the Missing Authorization (CWE-862).

WordPress sites using the Converter for Media – Optimize images | Convert WebP & AVIF plugin, version 6.3.2 or earlier, provided by the vendor mateuszgbiorczyk. All installations of these versions are affected until the plugin is upgraded beyond 6.3.2.

The vulnerability scores a CVSS of 4.3, indicating medium severity, and has an EPSS value of less than 1%, suggesting a low probability of exploitation at the current time. It is not listed in the CISA KEV catalog. An attacker who is authenticated and holds a Subscriber role or higher can exploit the lack of authorization by sending a request to the exposed REST endpoint, resulting in unauthorized deletion of optimized image data. While the attack requires credentials, the lack of role verification makes the exploitation relatively straightforward for legitimate users.