CVE-2025-11519

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11519", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-08T17:29:21.851Z", "datePublished": "2025-10-18T06:42:47.493Z", "dateUpdated": "2026-04-08T17:09:28.373Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:28.373Z"}, "affected": [{"vendor": "optimole", "product": "Optimole \u2013 Optimize Images in Real Time", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to offload media that doesn't belong to them."}], "title": "Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9288ed60-b14b-4188-84d4-efe770093551?source=cve"}, {"url": "https://research.cleantalk.org/CVE-2025-11519"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378645%40optimole-wp&new=3378645%40optimole-wp&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-10-09T21:13:01.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T18:03:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T19:02:41.179182Z", "id": "CVE-2025-11519", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T19:02:49.385Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11519", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T19:02:41.179182Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T19:02:45.747Z"}}], "cna": {"title": "Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "optimole", "product": "Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-09T21:13:01.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T18:03:14.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9288ed60-b14b-4188-84d4-efe770093551?source=cve"}, {"url": "https://research.cleantalk.org/CVE-2025-11519"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378645%40optimole-wp&new=3378645%40optimole-wp&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to offload media that doesn't belong to them."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-18T06:42:47.493Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11519", "state": "PUBLISHED", "dateUpdated": "2025-10-20T19:02:49.385Z", "dateReserved": "2025-10-08T17:29:21.851Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:47.493Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Optimole \u2013 Optimize Images in Real Time", "vendor": "optimole", "versions": [{"lessThanOrEqual": "4.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Optimole \u2013 Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to offload media that doesn't belong to them."}, {"lang": "es", "value": "El plugin Optimole - Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization para WordPress es vulnerable a Referencia Directa a Objeto Insegura en todas las versiones hasta la 4.1.0, inclusive, a trav\u00e9s del endpoint de la API REST /wp-json/optml/v1/move_image debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto permite a atacantes autenticados, con acceso de nivel Autor y superior, mover medios que no les pertenecen."}], "id": "CVE-2025-11519", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11519", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T19:02:41.179182Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:35.533", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378645%40optimole-wp&new=3378645%40optimole-wp&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/CVE-2025-11519"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9288ed60-b14b-4188-84d4-efe770093551?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:05:50.010246+00:00", "value": {"mitigation_remediation": ["Upgrade the Optimole plugin to a release newer than 4.1.0.", "If an immediate upgrade is not feasible, restrict access to the /wp-json/optml/v1/move_image endpoint for Author and higher roles by configuring server rules or a firewall, or modify the WordPress roles so that those users lack the capability to trigger the endpoint.", "Implement or enforce ACL checks so that the plugin validates ownership before permitting media offloading, ensuring that only the file owner can initiate the process."], "summary": {"action": "Patch", "impact": "Unauthorized Media Offload"}, "threat_synthesis": {"affected_systems": "All installations of the Optimole \u2013 Optimize Images plugin for WordPress with version 4.1.0 or earlier are affected. The issue affects the plugin component that handles media offloading via its REST API. No newer version information is provided in the available data.", "description_and_impact": "The vulnerability is an insecure direct object reference in the Optimole WordPress plugin, caused by missing validation on a user\u2011controlled key used in the /wp-json/optml/v1/move_image REST API endpoint. This flaw allows any authenticated user with Author level access or higher to offload media that does not belong to them, exposing content from other users.", "risk_and_exploitability": "The CVSS score of 4.3 denotes moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in CISA KEV catalog. Exploitation requires an authenticated WordPress user with author or higher privileges accessing the move_image endpoint. Once the request contains a valid, but unauthorized, key, the attacker may trigger a transfer of an arbitrary media file owned by another user, leading to cross\u2011tenant data leakage or disruption of the target user\u2019s content."}}}}, "created": "2025-10-20T13:21:31.981352+00:00", "updated": "2026-04-22T14:15:20.399676+00:00", "vendors": ["optimole", "optimole$PRODUCT$optimize_images", "wordpress", "wordpress$PRODUCT$wordpress"]}