CVE-2025-14482 Overview
CVE-2025-14482 is a missing authorization vulnerability in the Crush.pics Image Optimizer plugin for WordPress. The flaw affects all versions up to and including 1.8.7. Multiple AJAX functions in inc/class-ajax.php lack capability checks, allowing any authenticated user with Subscriber-level access or above to modify plugin settings. Attackers can disable auto-compression and alter image quality settings without administrative privileges. The vulnerability is categorized as Missing Authorization [CWE-862].
Critical Impact
Authenticated users with minimal privileges can tamper with image optimization settings, degrading site media quality and disabling automated compression workflows.
Affected Products
- Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress
- All versions up to and including 1.8.7
- WordPress sites running the plugin with Subscriber-level (or higher) user registration enabled
Discovery Timeline
- 2026-01-14 - CVE-2025-14482 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14482
Vulnerability Analysis
The Crush.pics Image Optimizer plugin exposes several AJAX action handlers that perform privileged configuration changes. These handlers, located in inc/class-ajax.php, do not verify whether the calling user holds the appropriate WordPress capability before executing settings updates. Because WordPress registers wp_ajax_* hooks for any authenticated session, attackers holding the lowest-tier Subscriber role can invoke these endpoints. The result is unauthorized modification of plugin configuration, including disabling auto-compression and changing image quality parameters.
Root Cause
The root cause is the absence of current_user_can() checks within the affected AJAX callbacks at lines 30, 66, and 193 of class-ajax.php. WordPress requires plugin authors to explicitly validate capabilities and verify nonces before processing state-changing requests. The plugin omits these guards on settings-mutating endpoints, defaulting to authenticated-only access rather than administrator-only. This pattern aligns with [CWE-862: Missing Authorization].
Attack Vector
Exploitation requires the attacker to hold a valid WordPress account at Subscriber level or higher. The attacker sends crafted POST requests to wp-admin/admin-ajax.php referencing the vulnerable plugin actions. No user interaction is needed beyond the attacker's own authenticated session. On sites that permit open user registration, this effectively lowers the barrier to any visitor who creates an account. The impact is limited to integrity of plugin configuration; confidentiality and availability are not directly affected. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review for the affected source lines.
Detection Methods for CVE-2025-14482
Indicators of Compromise
- Unexpected changes to Crush.pics plugin options in the wp_options table, particularly settings controlling auto-compression and image quality.
- POST requests to /wp-admin/admin-ajax.php originating from low-privilege user sessions targeting Crush.pics AJAX actions.
- New Subscriber-level accounts created shortly before configuration changes appear in plugin settings.
Detection Strategies
- Review WordPress audit logs for AJAX action invocations tied to the Crush.pics plugin from non-administrator users.
- Compare current plugin settings against a known-good baseline to identify unauthorized toggles of auto-compression or quality values.
- Inspect web server access logs for repeated admin-ajax.php requests carrying Crush.pics action parameters from the same authenticated session.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record settings changes and AJAX events with user attribution.
- Alert on modifications to plugin option keys outside of administrator-led maintenance windows.
- Monitor user role assignments and registration activity for unexpected growth in Subscriber accounts.
How to Mitigate CVE-2025-14482
Immediate Actions Required
- Update the Crush.pics Image Optimizer plugin to a release later than 1.8.7 once a patched version is published by the vendor.
- Disable open user registration on production WordPress sites that do not require it, reducing the pool of authenticated attackers.
- Audit existing Subscriber accounts and remove any that are unrecognized or inactive.
Patch Information
At the time of NVD publication, all versions through 1.8.7 are affected. Administrators should consult the Wordfence Vulnerability Report and the official plugin page on WordPress.org for the latest fixed version and apply the update through the WordPress plugin updater.
Workarounds
- Temporarily deactivate the Crush.pics plugin until a patched release is installed.
- Restrict access to /wp-admin/admin-ajax.php for low-privilege users via a web application firewall rule targeting Crush.pics action names.
- Set WordPress to require administrator approval for new user registrations, preventing automated Subscriber account creation.
# Example: disable open registration via wp-cli until the plugin is patched
wp option update users_can_register 0
wp plugin deactivate crush-pics
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
