The Crush.pics Image Optimizer plugin for WordPress has a missing capability check in several AJAX handling functions. This flaw allows any authenticated user with Subscriber-level access or higher to change the plugin’s configuration, such as disabling auto‑compression or adjusting image quality. The change is purely a configuration alteration and does not provide direct remote code execution or denial of service, but it can degrade site performance and alter the visitor experience.

Crush.pics Image Optimizer – Image Compression and Optimization for WordPress. All plugin releases from the initial version up to and including 1.8.7 are affected. No other vendors or products are impacted.

The CVSS score of 4.3 indicates a moderate impact level. The EPSS score of less than 1% signals that exploitation likelihood is currently low. The vulnerability is not listed in CISA’s KEV catalog. Attackers require only an authenticated WordPress account with Subscriber privileges and do not need higher privileges. The oversight is likely triggered through a web‑based AJAX request; once the attacker gains access, they can modify settings without any additional systems or network steps, making it relatively simple for a determined user to exploit.