CVE-2025-12190: WordPress Image Optimizer CSRF Vulnerability

CVE-2025-12190 Overview

CVE-2025-12190 is a Cross-Site Request Forgery [CWE-352] vulnerability in the Image Optimizer by wps.sk plugin for WordPress. The flaw affects all versions up to and including 1.2.0. The root cause is missing or incorrect nonce validation in the imagopby_ajax_optimize_gallery() function.

Unauthenticated attackers can trigger bulk image optimization by forging a request. Exploitation requires tricking a site administrator into clicking a malicious link or visiting an attacker-controlled page. The impact is limited to integrity of plugin operations, with no direct data disclosure or availability loss.

Critical Impact
Attackers can force administrators to execute unauthorized bulk optimization operations through forged requests, abusing plugin functionality without authentication.

Affected Products

Image Optimizer by wps.sk WordPress plugin, versions up to and including 1.2.0
WordPress sites with the plugin installed and active
Administrator accounts capable of triggering the vulnerable AJAX handler

Discovery Timeline

2025-12-05 - CVE-2025-12190 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12190

Vulnerability Analysis

The vulnerability resides in the imagopby_ajax_optimize_gallery() AJAX handler exposed by the Image Optimizer by wps.sk plugin. The handler processes bulk optimization requests but does not validate a WordPress nonce token before executing its logic. WordPress nonces serve as anti-CSRF tokens tied to a user session and action.

Without nonce validation, the endpoint accepts any authenticated request that arrives with valid session cookies. A browser will automatically attach those cookies when the administrator visits an attacker-controlled page. This gives an unauthenticated remote attacker an indirect path to invoke privileged plugin operations.

The scope of abuse is limited to what the imagopby_ajax_optimize_gallery() function performs: initiating bulk optimization jobs across media assets. There is no confidentiality impact and no availability impact reported in the advisory.

Root Cause

The plugin authors omitted a call to check_ajax_referer() or wp_verify_nonce() inside the AJAX handler. WordPress requires developers to explicitly verify nonces on state-changing endpoints. The absence of this check turns an administrator-only action into a CSRF-reachable one.

Attack Vector

An attacker crafts a page containing an HTML form or JavaScript that submits a POST request to admin-ajax.php with the action=imagopby_ajax_optimize_gallery parameter. The attacker sends the URL to a WordPress administrator through phishing, social media, or a compromised site. When the administrator visits the page while logged in, the browser submits the request with valid session cookies and triggers the optimization routine.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2025-12190

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action=imagopby_ajax_optimize_gallery originating from external referrers
Bulk image optimization jobs starting without a corresponding administrator initiation from the WordPress dashboard
Access log entries showing the AJAX endpoint hit with Referer headers pointing to third-party domains

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the vulnerable action parameter and correlate against expected administrator sessions
Monitor plugin activity logs for optimization events that lack a matching admin UI navigation trail
Deploy a WordPress security plugin or Web Application Firewall rule that flags AJAX requests missing a valid _wpnonce parameter

Monitoring Recommendations

Alert on cross-origin Referer or Origin headers targeting admin-ajax.php endpoints tied to the Image Optimizer plugin
Track anomalous spikes in image optimization job counts across the WordPress media library
Correlate administrator browser sessions with external link clicks preceding optimization events

How to Mitigate CVE-2025-12190

Immediate Actions Required

Deactivate the Image Optimizer by wps.sk plugin until a patched version is installed
Restrict administrator sessions to trusted browsers and enforce logout after use of the WordPress dashboard
Deploy a Web Application Firewall rule that blocks requests to the imagopby_ajax_optimize_gallery action without a valid nonce

Patch Information

At the time of publication, no fixed version is listed in the advisory data. Monitor the Wordfence Vulnerability Report and the plugin repository for a release that adds nonce validation. Update the plugin as soon as a patched version becomes available.

Workarounds

Remove or rename the plugin directory in wp-content/plugins/image-optimizer-wpssk/ to disable the vulnerable AJAX endpoint
Add server-level rules that block unauthenticated POST requests to admin-ajax.php when the action parameter matches imagopby_ajax_optimize_gallery
Train administrators to avoid clicking untrusted links while authenticated to the WordPress dashboard, and use separate browser profiles for admin work

bash

# Example WAF rule (ModSecurity syntax) to block requests missing a nonce
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012190,\
    msg:'CVE-2025-12190 CSRF attempt on Image Optimizer wps.sk'"
    SecRule ARGS:action "@streq imagopby_ajax_optimize_gallery" \
        "chain"
        SecRule &ARGS:_wpnonce "@eq 0"