CVE-2026-90953 in Image Optimizer Plugin
Summary
by MITRE • 09/30/2026
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in the Image Optimizer WordPress plugin prior to version 1.7.7 represents a significant authorization flaw rooted in improper access control mechanisms within the application's REST API implementation. Specifically, several endpoints designed for reading attachment metadata and retrieving site-wide statistics fail to enforce the necessary capability checks that restrict such operations to users with administrative privileges. In a typical WordPress environment, these types of sensitive data queries are protected by verifying that the requesting user possesses specific capabilities, such as manage_options or edit_posts, depending on the scope of the requested information. The absence of this verification logic allows any authenticated user, regardless of their assigned role or permission level within the site hierarchy, to access restricted resources through standard HTTP requests directed at these REST endpoints.
From a technical perspective, this flaw constitutes an Insecure Direct Object Reference combined with Broken Access Control vulnerabilities as defined by industry standards such as CWE-284 and CWE-639 respectively. The attacker leverages valid authentication credentials obtained through various means, including credential stuffing, phishing, or session hijacking, to interact directly with the API endpoints. Because the server does not validate whether the authenticated user has the requisite administrative rights before processing the request, it returns detailed metadata about images uploaded to the site and aggregate performance statistics intended exclusively for site administrators. This bypass of authorization logic is particularly dangerous in multi-author WordPress installations where contributors or authors might have legitimate access but should not possess visibility into global configuration data or sensitive asset information.
The operational impact of this vulnerability extends beyond simple data leakage, potentially facilitating further attacks against the web application and its underlying infrastructure. The exposure of attachment metadata can reveal file paths, internal identifiers, and optimization settings that may aid an attacker in crafting more targeted exploits against other components of the CMS. Furthermore, access to site-wide statistics might expose information about traffic patterns, storage usage, or third-party service integrations configured within the plugin, providing valuable intelligence for reconnaissance phases of a cyber attack. This aligns with techniques observed in the MITRE ATT&CK framework under T1087 Account Discovery and T1530 Data from Local System, where adversaries gather information to expand their foothold and understand the environment's structure before proceeding to more destructive actions such as data exfiltration or privilege escalation.
Mitigation strategies for this vulnerability are straightforward but require immediate action by site administrators and plugin maintainers. The primary remediation involves upgrading the Image Optimizer WordPress plugin to version 1.7.7 or later, where the developers have implemented proper capability checks on all affected REST routes. For organizations unable to upgrade immediately due to compatibility constraints, temporary mitigations include restricting access to the wp-json endpoint via web application firewall rules if feasible, although this may impact legitimate functionality. Additionally, enforcing strict role-based access control policies and monitoring API logs for unusual patterns of requests from non-administrative accounts can help detect potential exploitation attempts in real-time. Regular security audits and code reviews focusing on authorization logic are essential to prevent similar flaws in future updates or other plugins installed within the WordPress ecosystem.