CVE-2025-14482 is a missing authorization vulnerability (CWE-862) in the Crush.pics Image Optimizer WordPress plugin. The flaw exists because the plugin fails to enforce capability checks on several functions, enabling any authenticated user with at least Subscriber privileges to alter plugin settings. This includes disabling automatic image compression and adjusting image quality parameters. The issue affects all versions up to and including 1.8.7. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low impact on integrity and no impact on confidentiality or availability.

Authenticated users with Subscriber-level access or higher can modify plugin settings without proper authorization. This could degrade image optimization effectiveness by disabling auto-compression or lowering image quality, potentially affecting website performance or user experience. There is no direct impact on data confidentiality or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates for patches addressing this authorization issue.