Alexandru Bucur

**Name of the Vulnerable Software and Affected Versions** Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization versions prior to 4.2.7 **Description** The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a user into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation—a security token used to ensure requests are legitimate—within the `replace file()` function. Unauthenticated attackers can overwrite existing media attachments with malicious file content by sending a forged multipart POST request. This attack requires a victim with at least Author-level privileges, as the system verifies the `edit post` capability via the `current user can()` function for the targeted attachment. **Recommendations** Update to a version later than 4.2.6. As a temporary workaround, restrict access to the `replace file()` function until the update is applied.