CVE-2024-1338: ImageRecycle Plugin CSRF Vulnerability

CVE-2024-1338 Overview

CVE-2024-1338 is a Cross-Site Request Forgery (CSRF) vulnerability in the ImageRecycle pdf & image compression plugin for WordPress. The flaw affects all versions up to and including 3.1.13. It stems from missing or incorrect nonce validation on the stopOptimizeAll function. Unauthenticated attackers can modify image optimization settings by tricking a site administrator into clicking a crafted link. The vulnerability is classified under CWE-352.

Critical Impact
Attackers can alter plugin optimization settings on a target WordPress site when an authenticated administrator interacts with a malicious link or page.

Affected Products

ImageRecycle pdf & image compression plugin for WordPress
All versions up to and including 3.1.13
WordPress installations with the plugin active

Discovery Timeline

2024-02-29 - CVE-2024-1338 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1338

Vulnerability Analysis

The ImageRecycle plugin exposes a stopOptimizeAll function that halts running bulk image optimization jobs and can alter associated plugin settings. The endpoint lacks proper WordPress nonce verification, so it does not validate whether the request originated from a legitimate administrator session in the WordPress admin UI. An attacker who hosts a crafted page or embeds a malicious link can cause a logged-in administrator's browser to submit the request automatically. The result is unauthorized modification of image optimization settings without the administrator's consent.

Root Cause

The root cause is missing or incorrect nonce validation in the stopOptimizeAll handler. WordPress plugins are expected to enforce request authenticity using wp_verify_nonce() or check_admin_referer() calls tied to administrative actions. In vulnerable ImageRecycle builds, this control is absent, leaving the state-changing operation reachable through forged cross-origin requests. The weakness maps to CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation requires user interaction from a WordPress administrator with an active session. The attacker delivers a link, malicious advertisement, or attacker-controlled page that issues a request to the vulnerable endpoint on the target site. Because the browser automatically attaches the administrator's authentication cookies, the request is executed with administrator privileges. No authentication credentials need to be captured, and no prior access to the WordPress instance is required.

See the Wordfence Vulnerability Report and the WordPress Plugin Update Log for the corrective changeset.

Detection Methods for CVE-2024-1338

Indicators of Compromise

Unexpected changes to ImageRecycle plugin configuration or optimization state in the WordPress admin dashboard.
HTTP POST or GET requests to the plugin's admin-ajax endpoint referencing the stopOptimizeAll action from external Referer headers.
Administrator activity logs showing plugin setting changes without a corresponding admin console session.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php or plugin endpoints invoking stopOptimizeAll where the Referer header points to a domain outside the WordPress site.
Deploy a Web Application Firewall (WAF) rule that flags state-changing plugin requests missing a valid _wpnonce parameter.
Enable a WordPress audit-log plugin to record configuration changes and correlate them with administrator session activity.

Monitoring Recommendations

Alert on administrator-authenticated requests where the Referer or Origin header does not match the site's own hostname.
Track ImageRecycle plugin version across managed WordPress sites and flag installations at or below 3.1.13.
Review outbound links delivered to administrators via email or messaging platforms for suspicious redirects targeting the WordPress admin interface.

How to Mitigate CVE-2024-1338

Immediate Actions Required

Update the ImageRecycle pdf & image compression plugin to a version newer than 3.1.13, which includes the fix committed in changeset 3031424.
If an updated release is not yet available in your environment, deactivate and remove the plugin until it can be patched.
Instruct WordPress administrators to log out of the admin console when not actively managing the site.

Patch Information

The vendor addressed the missing nonce validation in the plugin source. The corrective code is available in the WordPress Plugin Update Log changeset 3031424. Administrators should apply the update through the WordPress plugin management screen or via WP-CLI.

Workarounds

Restrict WordPress admin access to specific source IP addresses using web server or WAF rules.
Configure a WAF policy that requires valid nonce parameters on plugin admin-ajax actions.
Use browser session isolation for WordPress administration to reduce exposure to cross-site request forgery from unrelated browsing activity.

bash

# Update the plugin using WP-CLI
wp plugin update imagerecycle-pdf-image-compression

# Verify installed version
wp plugin get imagerecycle-pdf-image-compression --field=version