CVE-2025-12190 is a CSRF vulnerability in the Image Optimizer by wps.sk WordPress plugin affecting all versions up to 1.2.0. The issue arises from missing or incorrect nonce validation in the imagopby_ajax_optimize_gallery() function, enabling attackers to perform unauthorized bulk image optimization actions if they can deceive an administrator into executing a crafted request. The vulnerability does not impact confidentiality or availability but can cause limited integrity impact. There are no known exploits in the wild, and no patch or vendor advisory has been provided yet.

An attacker can cause a site administrator to unknowingly initiate bulk image optimization operations, potentially leading to unintended processing or resource usage. The vulnerability does not disclose sensitive information or cause denial of service but may affect the integrity of the image optimization process. The impact is limited to the plugin's functionality and requires user interaction by an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links or performing actions initiated from unverified sources that could trigger the plugin's optimization function. Monitoring official vendor channels for updates is recommended.