SpeedSize Image and Video AI-Optimizer WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the SpeedSize Image & Video AI-Optimizer plugin for WordPress, affecting all versions through 1.5.1. The vulnerability arises from inadequate nonce validation in the 'speedsize_clear_css_cache_action' function, allowing unauthenticated attackers to clear the plugin's cache by sending a forged request, provided they can persuade a site administrator to click a link.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling attackers to clear the plugin's cache on behalf of an administrator.

Remediation

Users can update to version 1.5.2 or a newer patched version to address this vulnerability.