CVE-2026-11784

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action

View on CVE.org

Published Jun 18, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.

Analysis

Technical impact

The Optimole plugin for WordPress is vulnerable to cross‑site request forgery in all versions 4.2.6 and earlier. A missing or incorrect nonce check on the "optml_replace_file" AJAX action allows an attacker to craft a multipart POST request that overwrites any media attachment a user can edit. This results in unauthorized file replacement, potentially compromising site content and integrity.

Affected Systems

Any WordPress installation running Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization version 4.2.6 or earlier is affected. Administrators or authors who have edit permissions on media files are required to be tricked into performing the forged request.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low, though not absent. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a social‑engineering step to persuade a user with at least author privileges to click a malicious link, after which the forged request can overwrite attachments. If unmitigated, the attacker can replace critical media assets, potentially defacing the site or subverting content.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

optimole

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.2.6

No data.

Vendor Product Versions

Optimole

Optimole – Optimize Images | Convert Webp & Avif | Cdn & Lazy Load | Image Optimization

Version	Status	Scheme	Platform
`[0,4.2.6]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Optimole plugin to the latest version (4.2.7 or newer) to eliminate the missing nonce validation.
If an immediate upgrade is not possible, temporarily disable the vulnerable "optml_replace_file" AJAX action or deactivate the plugin until a patch is installed.
Review existing media attachments for unexpected changes and restore from backups if necessary.

Generated by OpenCVE AI on June 18, 2026 at 17:57 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.228% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php#L24
https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php#L331
https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php#L24
https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php#L331
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574315%40optimole-wp&new=3574315%40optimole-wp&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad?source=cve

History

Jun 21, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Optimole Optimole optimole – Optimize Images \| Convert Webp & Avif \| Cdn & Lazy Load \| Image Optimization Wordpress Wordpress wordpress
Vendors & Products		Optimole Optimole optimole – Optimize Images \| Convert Webp & Avif \| Cdn & Lazy Load \| Image Optimization Wordpress Wordpress wordpress

Jun 18, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
Title		Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Weaknesses		CWE-352
References		https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php#L24 https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php#L331 https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php#L24 https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php#L331 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574315%40optimole-wp&new=3574315%40optimole-wp&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`