CVE-2026-11784

Name of the Vulnerable Software and Affected Versions Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization versions prior to 4.2.7

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a user into performing actions they did not intend to. This occurs due to missing or incorrect nonce validation—a security token used to ensure requests are legitimate—within the replace file() function. Unauthenticated attackers can overwrite existing media attachments with malicious file content by sending a forged multipart POST request. This attack requires a victim with at least Author-level privileges, as the system verifies the edit post capability via the current user can() function for the targeted attachment.

Recommendations Update to a version later than 4.2.6. As a temporary workaround, restrict access to the replace file() function until the update is applied.