What’s Vulnerable › Vulnerabilities
CVE-2026-90953: Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-30 · updated 2026-09-30
- Weakness: CWE-200
Description
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
Affected products
- Image Optimizer: before 1.7.7 — fixed in 1.7.7
How to fix
Upgrade to a fixed version: Image Optimizer 1.7.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-90953 or the next vulnerability affects your stack