CVE-2024-6392 is a vulnerability classified under CWE-862 (Missing Authorization) affecting the Sirv Image Optimizer, Resizer and CDN plugin for WordPress. The root cause is the absence of proper capability checks on plugin functions responsible for managing the connection to the Sirv account. This omission allows any authenticated user with at least Subscriber-level privileges to modify plugin settings, specifically to change the linked Sirv account to one controlled by the attacker. Since WordPress Subscriber roles are typically low-privilege users, this vulnerability significantly lowers the bar for exploitation compared to requiring administrator access. The attack vector is remote network-based (AV:N) with low attack complexity (AC:L), requiring only privileges (PR:L) but no user interaction (UI:N). The vulnerability impacts confidentiality and integrity by enabling unauthorized control over CDN and image optimization resources, potentially allowing attackers to serve malicious or manipulated content via the compromised Sirv account. Availability is not directly impacted. The vulnerability affects all versions up to 7.2.7, with no patches currently linked, and no known exploits reported in the wild as of the publication date. The CVSS v3.1 base score is 5.4, reflecting medium severity.

The primary impact of CVE-2024-6392 is unauthorized modification of the Sirv plugin settings, which can lead to an attacker redirecting image optimization and CDN services to their own account. This can result in the delivery of malicious or altered images, undermining website content integrity and potentially facilitating further attacks such as phishing or malware distribution. Confidentiality is affected as attackers may gain insight into the legitimate Sirv account configuration. Although availability is not directly impacted, the integrity compromise can damage organizational reputation and user trust. Since the vulnerability can be exploited by low-privilege authenticated users, it increases the risk from insider threats or compromised low-level accounts. Organizations relying on this plugin for image optimization and CDN services are at risk of content tampering and indirect attacks leveraging the compromised media delivery chain.

Organizations should immediately review user roles and restrict Subscriber-level access to trusted users only, minimizing exposure. Until an official patch is released, consider disabling or uninstalling the Sirv plugin if feasible. Implement monitoring on plugin settings changes and audit WordPress user activities to detect unauthorized modifications. Employ Web Application Firewalls (WAFs) with custom rules to restrict access to plugin management endpoints to higher-privileged users only. Additionally, enforce strong authentication and consider multi-factor authentication (MFA) for all WordPress accounts to reduce the risk of account compromise. Stay informed on vendor updates and apply patches promptly once available. For environments where the plugin is critical, isolate the WordPress instance and limit network access to reduce the attack surface.