CVE-2024-1334 is a CSRF vulnerability in the ImageRecycle pdf & image compression WordPress plugin affecting all versions up to 3.1.13. The vulnerability arises from missing or incorrect nonce validation on the enableOptimization function, enabling attackers to perform unauthorized state-changing actions by tricking authenticated administrators into submitting forged requests. The vulnerability has a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting a network attack vector with low complexity, no privileges required, but user interaction needed, and limited integrity impact without confidentiality or availability loss.

An attacker can cause an administrator to unknowingly enable image optimization on the site by exploiting the CSRF vulnerability. This results in limited integrity impact as the attacker can alter plugin settings without authentication. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links and consider implementing additional CSRF protections such as web application firewalls or custom nonce validation. Monitor official ImageRecycle plugin updates for a security patch addressing this issue.