CVE-2024-1089 is a missing authorization vulnerability (CWE-862) in the ImageRecycle pdf & image compression WordPress plugin. The issue arises from the lack of a capability check in the optimizeAllOn function, enabling authenticated users with low privileges (subscriber-level and above) to modify image optimization settings. This vulnerability affects all versions up to and including 3.1.13. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with subscriber-level access or higher can modify image optimization settings without proper authorization. This could lead to unauthorized changes in how images are processed or compressed on the affected WordPress site. There is no direct impact on confidentiality or availability. The integrity of image optimization settings is affected, but the overall impact is limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for unauthorized changes to image optimization settings. Avoid granting unnecessary privileges to low-level authenticated users.