CVE-2024-6392: CWE-862 Missing Authorization in sirv Image Optimizer, Resizer and CDN – Sirv
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
AI Analysis
Technical Summary
CVE-2024-6392 is a missing authorization vulnerability (CWE-862) in the Sirv WordPress plugin 'Image Optimizer, Resizer and CDN' affecting all versions up to 7.2.7. The plugin fails to enforce capability checks on functions that modify plugin settings, enabling authenticated users with low privileges (Subscriber-level and above) to change the linked Sirv account to an attacker-controlled account. This could lead to unauthorized control over plugin configuration related to image optimization and CDN services.
Potential Impact
An attacker with Subscriber-level access or higher can modify the plugin's connected Sirv account, potentially redirecting image optimization and CDN services to an attacker-controlled account. This could lead to unauthorized use or manipulation of the plugin's functionality and resources. The impact is limited to confidentiality and integrity with no availability impact reported. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the Sirv plugin vendor for any forthcoming patches or official fixes.
CVE-2024-6392: CWE-862 Missing Authorization in sirv Image Optimizer, Resizer and CDN – Sirv
Description
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-6392 is a missing authorization vulnerability (CWE-862) in the Sirv WordPress plugin 'Image Optimizer, Resizer and CDN' affecting all versions up to 7.2.7. The plugin fails to enforce capability checks on functions that modify plugin settings, enabling authenticated users with low privileges (Subscriber-level and above) to change the linked Sirv account to an attacker-controlled account. This could lead to unauthorized control over plugin configuration related to image optimization and CDN services.
Potential Impact
An attacker with Subscriber-level access or higher can modify the plugin's connected Sirv account, potentially redirecting image optimization and CDN services to an attacker-controlled account. This could lead to unauthorized use or manipulation of the plugin's functionality and resources. The impact is limited to confidentiality and integrity with no availability impact reported. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the Sirv plugin vendor for any forthcoming patches or official fixes.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-06-27T16:18:22.936Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6c02b7ef31ef0b55eeb4
Added to database: 2/25/2026, 9:39:14 PM
Last enriched: 4/9/2026, 8:18:46 PM
Last updated: 4/12/2026, 6:18:27 PM
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.