CVE-2024-1090 is a missing authorization vulnerability (CWE-862) in the ImageRecycle pdf & image compression WordPress plugin. The issue arises from the absence of a capability check on the stopOptimizeAll function, enabling authenticated users with low privileges (subscriber-level and above) to alter image optimization settings. This could lead to unauthorized modification of plugin data. The vulnerability affects all versions up to and including 3.1.13. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact primarily on integrity with no confidentiality or availability impact.

An attacker with subscriber-level access or higher can modify image optimization settings in the plugin without proper authorization. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized changes to image optimization settings. Avoid granting subscriber-level access to untrusted users.