CVE-2026-90953
Deferred Deferred - Pending Action

WordPress Image Optimizer Plugin Unauthorized Data Access

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: WPScan

Description
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-10-19
AI Q&A
2026-09-30
EPSS Evaluated
2026-10-18
NVD
CVE-2026-90953
EUVD
EUVD-2026-89617

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_media the_image_optimizer to 1.7.7 (exc)
elementor image_optimizer to 1.7.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Image Optimizer by Elementor WordPress plugin before version 1.7.7. It allows any authenticated user, even with basic Subscriber-level access, to access sensitive data like attachment metadata and site-wide statistics that should only be available to administrators.

Detection Guidance

Check the installed version of the Image Optimizer by Elementor plugin. If it is below 1.7.7, the vulnerability is present. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If you use the vulnerable plugin version, unauthorized users could view private attachment details and site statistics. This could expose sensitive information about your WordPress site's media library and usage patterns.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (if personal data is exposed) or HIPAA (if protected health information is involved). Organizations must ensure proper access controls to maintain compliance.

Mitigation Strategies

Update the Image Optimizer by Elementor plugin to version 1.7.7 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent unauthorized access to sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90953. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart