CVE-2025-11455
Received Received - Intake

Unauthorized File Replacement in Perfect Images WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2025-11455
EUVD
EUVD-2025-211230

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tigroumeow Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Perfect Images plugin for WordPress has a vulnerability due to a missing capability check in its REST API endpoint /wp-json/wp-retina-2x/v1/replace. This flaw allows authenticated users with Author-level access or higher to replace files that do not belong to them, potentially leading to unauthorized file modifications.

Detection Guidance

Check WordPress sites using the Perfect Images plugin version 7.2.0 or lower. Look for unauthorized file replacements in the REST API endpoint /wp-json/wp-retina-2x/v1/replace. Review server logs for suspicious API requests from Author-level users or above.

Impact Analysis

If you use the Perfect Images plugin on your WordPress site, attackers with Author access could replace your files without permission. This may disrupt your website's functionality, alter images or other assets, or lead to data corruption. The impact is limited to file replacement and does not directly expose sensitive data.

Mitigation Strategies

Update the Perfect Images plugin to the latest version. Remove Author-level access for users unless absolutely necessary. Monitor file changes and restrict API access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart