CVE-2024-1338 is a CSRF vulnerability in the ImageRecycle pdf & image compression WordPress plugin affecting all versions up to 3.1.13. The issue arises from missing or incorrect nonce validation on the stopOptimizeAll function, which controls image optimization settings. An attacker can exploit this by tricking an authenticated administrator into submitting a forged request, thereby modifying plugin settings without authorization. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low attack complexity and no required privileges but requiring user interaction.

An attacker can cause unauthorized modification of image optimization settings in the affected plugin by exploiting the CSRF vulnerability. This does not lead to data disclosure or denial of service but may impact the integrity of plugin configuration. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges and consider disabling or limiting the use of the affected plugin. Implementing additional CSRF protections at the WordPress or server level may help mitigate risk.