CVE-2025-12190 is a medium-severity vulnerability classified as CWE-352 (Cross-Site Request Forgery) found in the Image Optimizer plugin by wps.sk for WordPress. The vulnerability exists in all versions up to and including 1.2.0 due to missing or incorrect nonce validation in the imagopby_ajax_optimize_gallery() function. Nonces in WordPress are security tokens used to verify that requests originate from legitimate users and prevent CSRF attacks. Without proper nonce validation, attackers can craft malicious requests that, when executed by an authenticated administrator (e.g., by clicking a link), trigger bulk image optimization operations without authorization. Although the impact on confidentiality and availability is negligible, the integrity of the site’s image optimization process can be compromised, potentially leading to unwanted resource consumption or disruption of image management workflows. The attack vector is remote with no privileges required but does require user interaction. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting its medium severity. No public exploits or patches are currently available, but the vulnerability has been officially published and reserved since late October 2025. Organizations using this plugin should monitor for updates and prepare to apply fixes promptly.

The primary impact of this vulnerability is on the integrity of the affected WordPress sites. An attacker can cause unauthorized bulk image optimization operations by exploiting the CSRF flaw, potentially leading to unintended modifications of media assets or increased server load. While this does not directly expose sensitive data or cause denial of service, it could disrupt normal site operations or degrade performance. Since the attack requires an administrator to be tricked into clicking a malicious link, social engineering is a key component. Organizations with high volumes of media content or those relying heavily on image optimization for performance may experience operational disturbances. Additionally, if combined with other vulnerabilities or misconfigurations, this flaw could be part of a larger attack chain. The lack of known exploits in the wild reduces immediate risk, but the widespread use of WordPress and its plugins means many sites could be vulnerable if not patched timely.

To mitigate this vulnerability, organizations should: 1) Monitor the plugin vendor’s official channels for security patches and apply updates immediately once available. 2) Until a patch is released, restrict administrative access to trusted personnel and enforce strong authentication mechanisms such as multi-factor authentication (MFA) to reduce the risk of compromised admin accounts. 3) Educate administrators and users about the risks of clicking unsolicited or suspicious links, especially those that could trigger administrative actions. 4) Implement web application firewalls (WAFs) with rules designed to detect and block CSRF attack patterns targeting the plugin’s AJAX endpoints. 5) Review and harden nonce validation mechanisms in custom or third-party plugins to prevent similar vulnerabilities. 6) Regularly audit WordPress plugins and remove or replace those that are no longer maintained or have known security issues. 7) Employ security plugins that can detect abnormal bulk operations or unauthorized changes to media libraries.