CVE-2026-11784
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Optimole plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 4.2.6. The issue arises from missing or incorrect nonce validation in the replace_file function, allowing unauthenticated attackers to overwrite existing media attachments.
Risk Assessment
Attackers can exploit this vulnerability to overwrite files on the server, potentially leading to data loss or the introduction of malware. The risk increases when administrators are tricked into performing actions that enable the attack.
Recommendation
It is recommended to update the Optimole plugin to the latest version to mitigate this vulnerability. Additionally, implementing extra security measures to minimize the risk of user deception is advisable.
Other vulnerabilities in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress
See all- CVE-2026-120739High
The Optimole plugin for WordPress (up to 4.2.18) is vulnerable to stored cross-site scripting via the `missing_srcsets[*][*].s` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. The HMAC signature required for REST endpoint authorization is published in plaintext inside the `optimoleDataOptimizer` JavaScript object on pages with an incomplete profile, effectively removing the authentication barrier.
- CVE-2026-120677High
The Optimole plugin for WordPress (up to 4.2.18) is vulnerable to stored cross-site scripting via the `comment` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires the comment to be approved by an administrator and the affected post to contain at least one iframe or video element (e.g., a core Video block), which is sufficient under default plugin settings where video lazy loading is enabled.
Original NVD description (English source)
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS