CVE-2024-1336 is a CSRF vulnerability in the ImageRecycle pdf & image compression WordPress plugin affecting all versions up to 3.1.13. The issue arises from missing or incorrect nonce validation on the optimizeAllOn function, enabling unauthenticated attackers to modify image optimization settings by tricking an administrator into executing a forged request. This vulnerability impacts the integrity of plugin settings but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.3 (medium severity). There is no vendor advisory or patch information available, and the product is not a cloud service.

An attacker can modify image optimization settings without authorization by exploiting the CSRF vulnerability if they can convince an authenticated administrator to perform an action such as clicking a malicious link. This affects the integrity of the plugin's configuration but does not compromise confidentiality or availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.