CVE-2024-8120 is a CSRF vulnerability in the ImageRecycle pdf & image compression WordPress plugin affecting all versions up to 3.1.14. The issue arises from missing or incorrect nonce validation in the class/class-image-otimizer.php file, enabling attackers to perform unauthorized state-changing actions by tricking authenticated administrators into submitting forged requests. This vulnerability does not require privileges beyond user interaction (UI:R) but can lead to integrity loss of plugin settings. The CVSS 3.1 base score is 4.7, reflecting network attack vector, low complexity, no privileges required, user interaction required, scope changed, no confidentiality or availability impact, and low integrity impact.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly modify plugin settings or perform other actions within the plugin. This can lead to unauthorized changes in the plugin configuration, potentially affecting the website's image compression behavior or related functionality. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.