WordPress Plugin Vulnerabilities

Robin image optimizer < 1.7.0 - Missing Authorization

Description

The Robin image optimizer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportAction() function in versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to export logs.

Affects Plugins

Plugin icon
robin-image-optimizer
Fixed in 1.7.0

References

CVE
CVE-2024-43122
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/15ccc672-f692-4d6b-abe6-15f6ea42902b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
2a47141b-f689-4732-9c43-62df4dae07c3

Timeline

Publicly Published
2024-08-07 (about 1 year ago)
Added
2024-08-14 (about 1 year ago)
Last Updated
2024-08-14 (about 1 year ago)

Other

Published
Title
Published
2025-04-15
Title
Barcode Generator for WooCommerce < 2.0.5 - Authenticated (Subscriber+) Arbitrary Content Deletion
Published
2025-06-05
Title
Job Board Manager < 2.1.61 - Missing Authorization
Published
2022-11-28
Title
Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure
Published
2024-04-29
Title
Progressive WordPress (PWA) <= 2.1.13 - Missing Authorization
Published
2025-10-16
Title
Event Tickets < 5.26.4 - Missing Authorization