WordSec
WordSec

Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update

2024-10-17 15:44
Francesco Carlucci

Strategic Overview

Status
Unpatched
Affected PluginBulk images optimizer: Resize, optimize, convert to webp, rename …
Affected Version<= 2.0.1
CVSS4.3Medium
CVECVE-2024-9361
View all Bulk images optimizer: Resize, optimize, convert to webp, rename … vulnerabilities

Vulnerability Overview

The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_configuration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options.

Technical Analysis

REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

External References

https://www.cve.org/CVERecord?id=CVE-2024-9361https://www.wordfence.com/threat-intel/vulnerabilities/id/a189e436-e8af-4379-aa6e-2d1a4a2d4bfa

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C

Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update (CVE-2024-9361)