CVE-2025-12190
BaseFortify
Publication date: 2025-12-05
Last updated on: 2025-12-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wps.sk | image_optimizer | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in the Image Optimizer by wps.sk plugin for WordPress, affecting all versions up to 1.2.0. It occurs because the plugin's imagopby_ajax_optimize_gallery() function lacks proper nonce validation, allowing an attacker to trick a site administrator into triggering bulk image optimization via a forged request without authentication.
How can this vulnerability impact me? :
An attacker can cause a site administrator to unknowingly perform bulk image optimization actions, potentially leading to unintended resource usage or disruption of normal site operations. Since the vulnerability does not allow data disclosure or system compromise, the impact is limited to integrity issues related to unauthorized actions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized or forged AJAX requests to the bulk optimization endpoint related to the imagopby_ajax_optimize_gallery() function in the Image Optimizer by wps.sk plugin. Since the vulnerability involves Cross-Site Request Forgery (CSRF) allowing unauthenticated attackers to trigger bulk optimization, you can look for unusual POST requests to the AJAX action 'imagopby_optimize_gallery' from non-admin users or unexpected sources. Commands to detect such activity could include inspecting web server logs for suspicious POST requests, for example using grep: 1. grep 'admin-ajax.php' /path/to/access.log | grep 'action=imagopby_optimize_gallery' 2. Use tools like curl or Burp Suite to test if the AJAX endpoint accepts requests without proper nonce validation. 3. Monitor WordPress admin activity logs for unexpected bulk optimization actions. Note that no specific detection commands are provided in the resources, but these general approaches align with the vulnerability context. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Update the Image Optimizer by wps.sk plugin to a version later than 1.2.0 where the nonce validation issue is fixed. 2. If an update is not yet available, restrict access to the AJAX bulk optimization endpoint by limiting permissions to trusted administrators only and ensuring proper nonce validation is enforced. 3. Disable or remove the plugin temporarily if possible to prevent exploitation. 4. Educate site administrators to avoid clicking on suspicious links that could trigger CSRF attacks. 5. Implement web application firewall (WAF) rules to block unauthorized POST requests to the AJAX endpoint. These steps help prevent unauthenticated attackers from triggering bulk image optimization via forged requests. [3]