CVE-2024-9361 is a missing authorization vulnerability (CWE-862) in the Bulk images optimizer WordPress plugin by giuliopanda. The issue arises because the 'save_configuration' function lacks a capability check, enabling authenticated users with low privileges (Subscriber and above) to update plugin options. This vulnerability affects all versions up to and including 2.0.1. The CVSS 3.1 base score is 4.3 (medium), reflecting the potential for unauthorized integrity modification without impact on confidentiality or availability. No patch or official vendor advisory is currently available.

An attacker with at least Subscriber-level access can modify plugin configuration options without proper authorization. This unauthorized modification could lead to altered plugin behavior or settings, potentially affecting site functionality or security posture. There is no direct impact on confidentiality or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for an official patch or mitigation instructions.