{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67624", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-09T16:46:50.744Z", "datePublished": "2026-02-20T15:46:28.340Z", "dateUpdated": "2026-04-28T16:14:22.848Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "optimize-more-images", "product": "Optimize More! \u2013 Images", "vendor": "Arya Dhiratara", "versions": [{"lessThanOrEqual": "1.1.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:27.245Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Arya Dhiratara Optimize More! \u2013 Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Optimize More! \u2013 Images: from n/a through <= 1.1.3.</p>"}], "value": "Missing Authorization vulnerability in Arya Dhiratara Optimize More! \u2013 Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! \u2013 Images: from n/a through <= 1.1.3."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:22.848Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/optimize-more-images/vulnerability/wordpress-optimize-more-images-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Optimize More! \u2013 Images plugin <= 1.1.3 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T21:32:21.869996Z", "id": "CVE-2025-67624", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:57:06.763Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67624", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T21:32:21.869996Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:32:23.244Z"}}], "cna": {"title": "WordPress Optimize More! \u2013 Images plugin <= 1.1.3 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arya Dhiratara", "product": "Optimize More! &#8211; Images", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.1.3"}], "packageName": "optimize-more-images", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:27.245Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/optimize-more-images/vulnerability/wordpress-optimize-more-images-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Arya Dhiratara Optimize More! &#8211; Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! &#8211; Images: from n/a through <= 1.1.3.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Arya Dhiratara Optimize More! &#8211; Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Optimize More! &#8211; Images: from n/a through <= 1.1.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:13:54.035Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67624", "state": "PUBLISHED", "dateUpdated": "2026-04-27T17:57:06.763Z", "dateReserved": "2025-12-09T16:46:50.744Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:46:28.340Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Arya Dhiratara Optimize More! \u2013 Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! \u2013 Images: from n/a through <= 1.1.3."}, {"lang": "es", "value": "Vulnerabilidad por falta de autorizaci\u00f3n en Arya Dhiratara Optimize More! \u2013 Images optimize-more-images permite explotar niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Optimize More! \u2013 Images: desde n/a hasta &lt;= 1.1.3."}], "id": "CVE-2025-67624", "lastModified": "2026-04-28T19:35:39.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-02-20T16:22:02.890", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/optimize-more-images/vulnerability/wordpress-optimize-more-images-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Optimize More! &#8211; Images", "source": "cna", "vendor": "Arya Dhiratara"}, "product": "optimize_more!_&#8211;_images", "vendor": "arya_dhiratara"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-29T00:53:34.552517+00:00", "value": {"mitigation_remediation": ["Update the Optimize More! \u2013 Images plugin to a version newer than 1.1.3 to remove the broken access control logic.", "Configure role\u2011based permissions in WordPress to ensure only trusted administrator roles can access plugin administrative pages and endpoints.", "Disable or restrict the plugin\u2019s unused URLs and features through the WordPress settings or a custom firewall rule to limit exposure."], "summary": {"action": "Patch", "impact": "Unauthorized access to WordPress plugin functions"}, "threat_synthesis": {"affected_systems": "Arya Dhiratara\u2019s Optimize More! \u2013 Images plugin for WordPress is impacted. All installations running the plugin up to and including version 1.1.3 are vulnerable. Users whose sites rely on this plugin for media optimization should review the current version and apply the latest update.", "description_and_impact": "The Optimize More! \u2013 Images plugin for WordPress, versions up to 1.1.3, contains a missing authorization flaw that permits exploitation of incorrectly configured access control levels. This defect allows an attacker to bypass required permissions and use the plugin\u2019s image optimization features or modify its settings without proper authentication. The resulting unauthorized use can alter media handling, potentially deface the site, or misuse backend capabilities, damaging confidentiality and integrity of site content. The weakness is identified as CWE-862 \u2013 Broken Access Control.", "risk_and_exploitability": "The CVSS score of 6.5 marks the vulnerability as moderate. The EPSS score of less than 1% suggests that exploitation is rare. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could send crafted requests to the plugin\u2019s URLs that do not enforce proper access control, enabling unauthorized use of image optimization functions even by users with limited privileges. The exact authentication requirements remain unclear because the description does not specify if the user needs to be authenticated."}}}}, "created": "2026-02-23T14:46:30.851588+00:00", "updated": "2026-04-29T01:00:11.398896+00:00", "vendors": ["arya_dhiratara", "arya_dhiratara$PRODUCT$optimize_more!_&#8211;_images", "wordpress", "wordpress$PRODUCT$wordpress"]}