CVE-2025-11455

Name of the Vulnerable Software and Affected Versions Perfect Images versions prior to 7.2.1

Description The plugin allows unauthorized modification of data because it fails to perform a capability check on the '/wp-json/wp-retina-2x/v1/replace' REST API endpoint. This flaw enables authenticated users with Author-level permissions or higher to replace files that they do not own.

Recommendations Update the plugin to a version newer than 7.2.0. Restrict access to the '/wp-json/wp-retina-2x/v1/replace' endpoint to minimize the risk of unauthorized file replacement.