The vulnerability CVE-2025-11519 in the Optimole WordPress plugin arises from insufficient validation of a user-controlled key parameter in the /wp-json/optml/v1/move_image REST API endpoint. This allows authenticated users with Author-level privileges or above to bypass authorization controls and offload media assets owned by other users. The issue is classified as an Insecure Direct Object Reference (CWE-639) and affects all plugin versions up to and including 4.1.0. The CVSS 3.1 base score is 4.3, indicating medium severity with low complexity and no user interaction required.

The vulnerability enables authenticated users with Author-level access or higher to offload media files that they do not own, potentially leading to unauthorized access or manipulation of media content. There is no indication of confidentiality or availability impact, and the integrity impact is limited to unauthorized media offloading. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor plugin updates from the vendor. Avoid granting Author or higher privileges to untrusted users to reduce risk.