CVE-2022-2450 in Only Free Image Optimizer & Compress Plugin Plugin
Summary
by MITRE • 11/14/2022
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/25/2026
The reSmush.it WordPress plugin vulnerability represents a critical authorization flaw that undermines the security model of WordPress sites using this image optimization tool. This vulnerability specifically affects versions prior to 0.4.4 and stems from insufficient access control mechanisms within the plugin's AJAX handling functionality. The flaw allows any authenticated user account, regardless of role level, to execute administrative operations through improperly protected AJAX endpoints. This represents a significant deviation from standard WordPress security practices where administrative actions should require elevated privileges such as administrator or editor roles.
The technical implementation of this vulnerability lies in the plugin's failure to validate user permissions before executing sensitive operations through AJAX calls. When users access the plugin's administrative features via AJAX endpoints, the code does not verify whether the requesting user possesses sufficient privileges to perform the requested action. This authorization bypass occurs because the plugin's AJAX handlers lack proper capability checks, allowing subscribers and other low-privilege users to trigger operations that should be restricted to administrators. The vulnerability exists within the plugin's core functionality and affects the fundamental security architecture of WordPress installations that rely on this optimization tool.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it creates potential attack vectors for malicious actors who may compromise lower-privilege accounts. An attacker who gains access to a subscriber account could leverage this vulnerability to perform unauthorized image optimization operations, potentially leading to resource exhaustion or other unintended consequences. The vulnerability also enables denial of service scenarios where malicious users could flood the system with optimization requests, consuming server resources and affecting legitimate site operations. From a compliance perspective, this vulnerability violates the principle of least privilege and could result in security audits failing due to unauthorized access paths.
Mitigation strategies for this vulnerability involve immediate plugin updates to version 0.4.4 or later, which includes proper authorization checks for AJAX endpoints. System administrators should also implement additional monitoring of AJAX activity within WordPress installations to detect unusual patterns that might indicate exploitation attempts. The vulnerability aligns with CWE-863, which addresses "Incorrect Authorization" in software systems, and could be categorized under ATT&CK technique T1078 for Valid Accounts and T1496 for Resource Hijacking. Organizations should conduct thorough security assessments of all installed plugins to identify similar authorization flaws and ensure proper access controls are implemented across all administrative interfaces. Regular security scanning and vulnerability assessments remain essential practices to prevent exploitation of such authorization bypass vulnerabilities in WordPress environments.