CVE-2024-1091 is a missing authorization vulnerability (CWE-862) in the ImageRecycle pdf & image compression WordPress plugin. The issue arises because the reinitialize function lacks a capability check, enabling any authenticated user with subscriber-level privileges or above to modify plugin data unauthorizedly by removing all plugin data. This affects all versions up to and including 3.1.13. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, and privileges required at the low level (authenticated user).

An attacker with subscriber-level access or higher can remove all data related to the ImageRecycle plugin, leading to potential disruption of plugin functionality and loss of compressed image data. There is no direct confidentiality or availability impact reported, but integrity of plugin data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unauthorized changes to plugin data. Avoid granting unnecessary privileges to users. Follow vendor updates closely for any released patches or official mitigations.