CVE-2024-1335 Overview
CVE-2024-1335 is a Cross-Site Request Forgery (CSRF) vulnerability in the ImageRecycle pdf & image compression plugin for WordPress. The flaw affects all versions up to and including 3.1.13. The disableOptimization function lacks proper nonce validation, allowing unauthenticated attackers to forge requests that disable the image optimization setting. Exploitation requires tricking a site administrator into clicking a crafted link while authenticated. The issue is tracked as CWE-352.
Critical Impact
Successful exploitation disables the plugin's image optimization setting on behalf of an authenticated administrator, degrading site configuration integrity without the admin's consent.
Affected Products
- ImageRecycle pdf & image compression plugin for WordPress
- All versions up to and including 3.1.13
- Sites running administrator sessions where users can be lured to attacker-controlled pages
Discovery Timeline
- 2024-02-29 - CVE-2024-1335 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1335
Vulnerability Analysis
The ImageRecycle plugin exposes a disableOptimization function used to toggle the image optimization setting. The handler does not verify a WordPress nonce before executing state-changing logic. WordPress nonces are the framework's standard anti-CSRF token mechanism. Without this check, any authenticated administrator who loads an attacker-controlled page can be forced to issue the request. The browser automatically attaches the admin's session cookies, and WordPress treats the request as legitimate.
The impact is limited to integrity of a plugin configuration setting. No confidentiality or availability loss results directly, and no authentication bypass or code execution occurs. However, disabling optimization silently can affect site performance, bandwidth consumption, and media delivery pipelines that assume optimization is active.
Root Cause
The root cause is missing or incorrect nonce validation on the disableOptimization action handler. WordPress plugin developers are expected to call check_admin_referer() or wp_verify_nonce() on any state-changing endpoint. The absence of this check means the request's authenticity is never validated. The fix was published in the plugin's WordPress changeset 3031424.
Attack Vector
An attacker crafts an HTML page containing a form or image tag that triggers the vulnerable request to the target WordPress site. The attacker lures a logged-in administrator to visit the page through phishing, a comment link, or a compromised third-party site. The administrator's browser submits the forged request with valid session cookies. The plugin executes disableOptimization without verifying intent, silently disabling the setting.
No exploitation code is published for this issue. Technical specifics are documented in the Wordfence vulnerability report.
Detection Methods for CVE-2024-1335
Indicators of Compromise
- Unexpected changes to the ImageRecycle optimization setting in the WordPress admin dashboard without a corresponding admin audit log entry
- Administrator browser history showing visits to untrusted external pages immediately before the setting changed
- HTTP referer headers pointing to third-party domains in web server logs for ImageRecycle plugin endpoints
Detection Strategies
- Review web server access logs for POST or GET requests to ImageRecycle plugin handlers originating with cross-origin referers
- Monitor the WordPress options table for unexpected toggling of ImageRecycle optimization keys
- Correlate administrator session activity with external referer patterns to identify likely CSRF attempts
Monitoring Recommendations
- Enable WordPress audit logging plugins to record administrator setting changes with user, timestamp, and source IP
- Alert on plugin configuration changes outside documented change windows
- Track plugin version inventory and flag sites still running ImageRecycle 3.1.13 or earlier
How to Mitigate CVE-2024-1335
Immediate Actions Required
- Update the ImageRecycle pdf & image compression plugin to a version later than 3.1.13 that includes the fix from changeset 3031424
- Verify the ImageRecycle optimization setting reflects the intended configuration after patching
- Advise administrators to log out of WordPress when not actively managing the site
Patch Information
The vendor addressed the issue in the WordPress plugin repository. The corrective commit is published as WordPress plugin changeset 3031424 and adds the missing nonce validation to the disableOptimization handler. Site operators should apply the update through the standard WordPress plugin update workflow.
Workarounds
- Deactivate the ImageRecycle plugin until the patched version is installed if updating is not immediately possible
- Restrict administrator access using IP allowlists on /wp-admin to reduce exposure to CSRF lures
- Deploy a web application firewall rule that blocks requests to ImageRecycle endpoints when the HTTP referer is not the site's own domain
# Example WordPress CLI update command
wp plugin update imagerecycle-pdf-image-compression
wp plugin get imagerecycle-pdf-image-compression --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
