Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery zur Massenbildoptimierung

The primary impact of this CSRF vulnerability lies in the potential for unauthorized bulk optimization of images. An attacker could craft a malicious link that, when clicked by a WordPress administrator, would initiate the optimization process without their knowledge or consent. This could lead to excessive server load, resource exhaustion, and potentially degrade website performance. While the vulnerability doesn't directly expose sensitive data, the attacker could leverage it to disrupt site operations or perform other actions depending on the plugin's functionality and administrator privileges.

WordPress websites utilizing the Image Optimizer by wps.sk plugin, particularly those with administrator accounts that are regularly exposed to phishing attempts or other social engineering tactics, are at risk. Shared hosting environments where multiple websites share the same server resources could experience broader impact if one site is compromised.

• wordpress / composer / npm:

grep -r 'imagopby_ajax_optimize_gallery' /var/www/html/wp-content/plugins/image-optimizer-by-wps-sk/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=imagopby_ajax_optimize_gallery&some_param=value | grep -i 'referer'

• wordpress / composer / npm:

wp plugin list --status=inactive | grep 'image-optimizer-by-wps-sk'

1. 2025-12-05Disclosure

   disclosure

1. Reserviert2025-10-24
2. Veröffentlicht2025-12-05
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-12190 is to immediately upgrade the Image Optimizer by wps.sk plugin to a version that addresses the vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out requests lacking proper nonce validation for the imagopbyajaxoptimize_gallery() function. Additionally, restrict administrator access to the plugin's optimization features and educate users about the risks of clicking suspicious links. After upgrading, verify the fix by attempting to trigger the optimization process via a crafted URL and confirming that it is blocked.