WordPress security changelog
MEDIUM CVE-2026-11784 Deferred

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: Cross-site request forgery

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is <= 4.2.6.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
Plugin slug
optimole-wp
Affected
<= 4.2.6
Safe version
> 4.2.6
Published
Jun 18, 2026
Weakness
CWE-352 — Cross-Site Request Forgery (CSRF)

This CVE was published Jun 18, 2026 and is one of 5 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization to a release after 4.2.6, or disable and remove it until a fixed version is available.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Primary and upstream sources