CVE-2024-1336: ImageRecycle WordPress Plugin CSRF Vulnerability

CVE-2024-1336 Overview

CVE-2024-1336 is a Cross-Site Request Forgery (CSRF) vulnerability in the ImageRecycle pdf & image compression plugin for WordPress. The flaw affects all versions up to and including 3.1.13. It stems from missing or incorrect nonce validation on the optimizeAllOn function. Unauthenticated attackers can modify image optimization settings by tricking a site administrator into clicking a crafted link. The vulnerability is tracked under CWE-352 (Cross-Site Request Forgery).

Critical Impact
Attackers can alter image optimization configuration on affected WordPress sites by coercing an authenticated administrator into interacting with a malicious request.

Affected Products

ImageRecycle pdf & image compression plugin for WordPress, versions up to and including 3.1.13
WordPress sites with the vulnerable plugin installed and activated
Administrator accounts targeted through social engineering vectors

Discovery Timeline

2024-02-29 - CVE-2024-1336 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1336

Vulnerability Analysis

The plugin exposes the optimizeAllOn function without a valid WordPress nonce check. WordPress nonces are per-user tokens designed to confirm that a state-changing request originated from an authorized user interface. When these tokens are missing or improperly validated, the endpoint accepts any request that arrives with a valid administrator session cookie.

An attacker exploits this by hosting a page that submits a forged request to the target WordPress site. If a logged-in administrator visits the attacker-controlled page, the browser attaches session cookies automatically, and the request is processed with administrative privileges. The impact is limited to modifying image optimization settings, so confidentiality and availability are not affected.

User interaction is required, which reduces the practical attack surface but does not eliminate risk on high-value or high-traffic administrator accounts.

Root Cause

The root cause is the absence or misuse of wp_verify_nonce() (or the check_admin_referer() wrapper) around the optimizeAllOn handler. Without this validation, the endpoint cannot distinguish between legitimate administrative actions and cross-origin requests forged by an attacker.

Attack Vector

Exploitation requires an unauthenticated remote attacker to deliver a crafted link, form, or embedded resource to a WordPress administrator. When the administrator loads the resource while authenticated, the browser issues the forged request. The change is applied to the plugin's optimization configuration with no additional confirmation.

No authenticated code path or elevated privileges are required from the attacker side. See the Wordfence Vulnerability Report and the WordPress Plugin Change Log for the corresponding code path and remediation.

Detection Methods for CVE-2024-1336

Indicators of Compromise

Unexpected changes to ImageRecycle plugin optimization settings without corresponding administrator activity in audit logs
Web server access logs showing POST requests to the ImageRecycle optimizeAllOn endpoint originating from external Referer headers
Administrator sessions producing state-changing plugin requests immediately after visiting third-party URLs

Detection Strategies

Inspect WordPress request logs for calls to plugin admin-ajax or admin-post handlers that lack a corresponding _wpnonce parameter
Correlate plugin configuration changes with browser navigation events and email or messaging click-throughs targeting administrators
Alert on cross-origin Referer values on plugin administrative endpoints

Monitoring Recommendations

Enable file and database change monitoring for the wp_options entries associated with the ImageRecycle plugin
Retain WordPress audit logs for administrator actions and review anomalies against expected change windows
Monitor for outbound links delivered via phishing that reference the WordPress admin path of the site

How to Mitigate CVE-2024-1336

Immediate Actions Required

Update the ImageRecycle pdf & image compression plugin to a version later than 3.1.13 that includes the patch referenced in the WordPress plugin changeset
If an update is not immediately available, deactivate and remove the plugin until it can be patched
Require administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

The fix is documented in the WordPress Plugin Change Log for changeset 3031424. The patch adds nonce validation to the affected handler so that only requests originating from the WordPress administrative interface are accepted.

Workarounds

Restrict access to the WordPress admin path (/wp-admin/) using IP allow-listing at the web server or WAF layer
Deploy a web application firewall rule that blocks requests to the ImageRecycle plugin endpoints when the Referer header is absent or cross-origin
Enforce short administrator session lifetimes and require re-authentication for privileged actions

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to the plugin endpoint
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1003360,phase:2,deny,status:403,msg:'Block cross-origin request to ImageRecycle plugin'"
  SecRule REQUEST_URI "@contains imagerecycle-pdf-image-compression" \
    "chain"
    SecRule &REQUEST_HEADERS:Referer "@eq 0"