Optimole WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Unauthorized Media Offload

A vulnerability exists in the Optimole WordPress plugin, specifically in versions through 4.1.0. The issue is an Insecure Direct Object Reference (IDOR) that allows authenticated users with Author-level access or higher to offload media that does not belong to them. This vulnerability is accessible through the /wp-json/optml/v1/move_image REST API endpoint, where missing validation on a user-controlled key creates the opportunity for unauthorized media manipulation.

Impact

Exploitation of this vulnerability allows for unauthorized media offload, potentially leading to misuse or unauthorized access to media assets.

Remediation

Users can update to version 4.1.1 or a newer patched version to address this vulnerability.