CVE-2024-1338

Summary

CVE-2024-1338 is a new cross-site request forgery (CSRF) vulnerability affecting the ImageRecycle plugin for WordPress. This issue, present in all versions up to 3.1.13, arises due to inadequate nonce validation on the "stopOptimizeAll" function. As a consequence, unauthenticated attackers can manipulate image optimization settings by forging requests, and persuade site administrators to perform these malicious actions. This CSRF flaw poses a significant security risk, emphasizing the importance of promptly updating to the latest, patched version of the ImageRecycle plugin to mitigate the threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.