CVE-2024-6631 describes a missing authorization vulnerability in the ImageRecycle pdf & image compression WordPress plugin (up to version 3.1.14). The plugin fails to perform proper capability checks on multiple AJAX endpoints, enabling authenticated users with low privileges (Subscriber and above) to execute unauthorized actions such as updating plugin settings. This vulnerability is categorized under CWE-862 and has a CVSS 3.1 score of 5.0, reflecting a medium severity impact primarily on integrity. No patch or official fix information is currently available, and the plugin is not a cloud service.

An attacker with at least Subscriber-level access can exploit this vulnerability to modify plugin settings without proper authorization. While this does not directly affect confidentiality or availability, it impacts the integrity of the plugin configuration, potentially leading to further misuse or misconfiguration. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unusual changes in plugin settings. Avoid granting Subscriber or higher privileges to untrusted users to reduce risk.