Unauthorized Options Update Vulnerability in Instant Images Plugin for WordPress by Unsplash, Openverse, Pixabay, and Pexels

CVE-2024-0869

Summary

The Instant Images plugin for WordPress, which integrates resources from Unsplash, Openverse, Pixabay, and Pexels to facilitate one-click image uploads, is susceptible to an unauthorized arbitrary options update. This vulnerability arises from an inadequate validation process that fails to confirm whether the updated option pertains to the plugin itself on the instant-images/license REST API endpoint. This flaw is present in all versions up to and including 6.1.0, allowing users with author-level permissions or higher to modify arbitrary options within the plugin, which could lead to potential misconfigurations or unauthorized functionalities.

References