CVE-2024-1335 is a Cross-Site Request Forgery vulnerability in the ImageRecycle pdf & image compression plugin for WordPress, affecting all versions up to 3.1.13. The issue is due to missing or incorrect nonce validation on the disableOptimization function, allowing an attacker to forge requests that disable image optimization settings if a site administrator is tricked into performing an action such as clicking a crafted link. This vulnerability requires user interaction (UI:R) but no privileges (PR:N) and has no direct confidentiality or availability impact, only limited integrity impact.

An attacker can cause the image optimization feature to be disabled on a vulnerable WordPress site by tricking an administrator into clicking a malicious link. This could degrade the site's performance or user experience by disabling image compression. There is no direct impact on confidentiality or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security channels is recommended.