CVE-2025-11519 Overview
CVE-2025-11519 affects the Optimole image optimization plugin for WordPress in all versions up to and including 4.1.0. The vulnerability is an Insecure Direct Object Reference [CWE-639] in the /wp-json/optml/v1/move_image REST API endpoint. The endpoint fails to validate a user-controlled key, allowing authenticated attackers with Author-level access or higher to offload media that belongs to other users.
Critical Impact
Authenticated users with Author-level privileges can manipulate media assets they do not own by invoking the vulnerable REST endpoint with attacker-supplied identifiers.
Affected Products
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress
- All versions up to and including 4.1.0
- WordPress sites permitting Author-level or higher user registration
Discovery Timeline
- 2025-10-18 - CVE-2025-11519 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11519
Vulnerability Analysis
The Optimole plugin exposes a REST API route at /wp-json/optml/v1/move_image that handles offloading of media assets to the Optimole content delivery network. The endpoint accepts a user-supplied key referencing a media object. The handler does not verify that the requesting user owns or has permission to act on the referenced media item.
An authenticated attacker holding Author-level access can call the endpoint with the identifier of media belonging to another user. The plugin performs the move operation on the referenced object as if authorization had been established. The issue is a canonical Insecure Direct Object Reference: authentication is enforced, but object-level authorization is missing.
The confidentiality impact is none, integrity impact is low, and availability impact is none. Attackers gain the ability to modify media placement across the site without directly reading or destroying files.
Root Cause
The root cause is missing ownership validation on the media identifier passed to the move_image REST route. The plugin trusts the identifier supplied in the request rather than cross-checking the associated media record against the current user's capabilities and ownership.
Attack Vector
Exploitation requires network access to the WordPress REST API and authenticated Author-level credentials or higher. The attacker sends a crafted POST request to /wp-json/optml/v1/move_image referencing a target media identifier owned by another user. No user interaction is required from the victim. Because Author is a low-privilege role that many WordPress sites grant to contributors and content editors, the barrier to exploitation is modest.
No public proof-of-concept exploit is currently associated with this CVE. Technical details are documented in the Wordfence Vulnerability Analysis and the CleanTalk CVE-2025-11519 Report.
Detection Methods for CVE-2025-11519
Indicators of Compromise
- Unexpected POST requests to /wp-json/optml/v1/move_image in web server or WordPress access logs
- Media library entries showing offload state changes not initiated by the owning user
- REST API calls originating from Author-level accounts targeting media identifiers outside their upload history
Detection Strategies
- Enable WordPress REST API request logging and alert on optml/v1/move_image invocations correlated with Author-level session tokens
- Compare the post_author field of media items referenced in move_image requests against the authenticated user ID in the request context
- Review Optimole plugin activity logs for offload operations grouped by initiating user to surface cross-owner activity
Monitoring Recommendations
- Forward WordPress and web server logs to a central analytics platform and build detections on abnormal REST endpoint usage
- Baseline expected volumes of move_image calls per user role and alert on deviations
- Monitor creation of new Author-level accounts followed by rapid REST API activity against media endpoints
How to Mitigate CVE-2025-11519
Immediate Actions Required
- Update the Optimole plugin to a version later than 4.1.0 that contains the fix referenced in the WordPress Plugin Changeset Update
- Audit existing Author-level and above accounts and remove unused or unrecognized users
- Review recent Optimole offload activity for signs of cross-user media manipulation
Patch Information
The vendor released a corrective changeset for the optimole-wp plugin visible in the WordPress plugin repository. Site administrators should install the latest available Optimole release through the WordPress admin dashboard or via the plugin update mechanism. Details are available in the WordPress Plugin Changeset Update.
Workarounds
- Restrict user registration and limit Author-level or higher role assignments to trusted accounts until the patch is applied
- Deploy a web application firewall rule blocking or challenging requests to /wp-json/optml/v1/move_image from non-administrator sessions
- Temporarily disable the Optimole plugin on sites where trusted user separation cannot be enforced
# Configuration example: update the Optimole plugin via WP-CLI
wp plugin update optimole-wp
wp plugin get optimole-wp --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
