Authorization Flaw in Image Optimizer WordPress Plugin by WPScan
CVE-2026-90953
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-90953?
The Image Optimizer WordPress plugin prior to version 1.7.7 contains an authorization flaw that fails to properly enforce capability checks on multiple read REST routes. This lack of enforcement permits authenticated users to access sensitive attachment metadata and site-wide statistics, which should ordinarily be restricted to administrators. This vulnerability poses a risk of unauthorized data exposure, allowing malicious users to gather information that could be exploited for further attacks.
Affected Version(s)
Image Optimizer 0 < 1.7.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.