Description
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
Published: 2026-06-18
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Optimole plugin for WordPress is vulnerable to cross‑site request forgery in all versions 4.2.6 and earlier. A missing or incorrect nonce check on the "optml_replace_file" AJAX action allows an attacker to craft a multipart POST request that overwrites any media attachment a user can edit. This results in unauthorized file replacement, potentially compromising site content and integrity.

Affected Systems

Any WordPress installation running Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization version 4.2.6 or earlier is affected. Administrators or authors who have edit permissions on media files are required to be tricked into performing the forged request.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low, though not absent. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a social‑engineering step to persuade a user with at least author privileges to click a malicious link, after which the forged request can overwrite attachments. If unmitigated, the attacker can replace critical media assets, potentially defacing the site or subverting content.

Generated by OpenCVE AI on June 18, 2026 at 17:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Optimole plugin to the latest version (4.2.7 or newer) to eliminate the missing nonce validation.
  • If an immediate upgrade is not possible, temporarily disable the vulnerable "optml_replace_file" AJAX action or deactivate the plugin until a patch is installed.
  • Review existing media attachments for unexpected changes and restore from backups if necessary.

Generated by OpenCVE AI on June 18, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
Title Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-06-18T13:03:09.076Z

Reserved: 2026-06-09T12:47:39.122Z

Link: CVE-2026-11784

cve-icon Vulnrichment

Updated: 2026-06-18T13:03:04.342Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T18:00:11Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)