CVE-2025-13750 is a missing authorization vulnerability (CWE-862) in the Converter for Media – Optimize images | Convert WebP & AVIF WordPress plugin. The vulnerability exists because the REST endpoint `/webp-converter/v1/regenerate-attachment` does not perform proper capability checks, allowing authenticated users with low privileges (Subscriber and above) to delete optimized image variants (WebP/AVIF) associated with arbitrary attachments. This could lead to unauthorized modification of plugin-managed image data. The vulnerability affects all versions up to 6.3.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and privileges required, with impact limited to integrity loss without confidentiality or availability impact.

An attacker with at least Subscriber-level access to a WordPress site using the affected plugin can delete optimized WebP and AVIF image variants for any attachment. This results in unauthorized modification of image data managed by the plugin, potentially degrading site media quality or causing inconvenience. There is no direct impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unusual activity related to image optimization. Avoid granting Subscriber or higher privileges to untrusted users. Follow the plugin vendor's updates closely for any forthcoming patches or official mitigations.