CVE-2025-13750

Name of the Vulnerable Software and Affected Versions The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions up to and including 6.3.2

Description The plugin is susceptible to unauthorized data modification because of a missing capability check on the /webp-converter/v1/regenerate-attachment REST endpoint. This allows authenticated attackers with Subscriber-level access or higher to delete optimized WebP/AVIF variants for any attachment. The affected API endpoint is /webp-converter/v1/regenerate-attachment.

Recommendations Versions prior to and including 6.3.2 should be updated.