CVE-2025-67624 identifies a missing authorization vulnerability in the WordPress plugin 'Optimize More! – Images' developed by Arya Dhiratara. This plugin is designed to optimize images on WordPress sites to improve performance. The vulnerability arises from incorrectly configured access control security levels, which means that certain actions intended to be restricted to authorized users can be performed by unauthorized attackers. Specifically, the plugin versions up to and including 1.1.3 do not properly enforce authorization checks before allowing image optimization or related operations. This flaw can be exploited remotely without authentication, allowing attackers to manipulate image optimization processes or potentially alter image data. Although no public exploits have been reported yet, the nature of the vulnerability suggests that attackers could leverage it to degrade website integrity, manipulate content, or cause denial of service by disrupting image handling. The lack of a CVSS score indicates that the vulnerability is newly disclosed and pending formal scoring. The vulnerability was reserved in December 2025 and published in February 2026, indicating recent discovery and disclosure. The absence of patch links suggests that a fix may not yet be available, emphasizing the need for immediate attention from site administrators.

The primary impact of CVE-2025-67624 is unauthorized access to image optimization functions within affected WordPress sites. This can lead to unauthorized modification or deletion of images, potentially affecting website content integrity and availability. For organizations relying heavily on visual content, such as e-commerce, media, and marketing sites, this could degrade user experience and damage brand reputation. Additionally, attackers might exploit this flaw to inject malicious content or disrupt site functionality, leading to broader security risks. Since the vulnerability does not require authentication, it increases the attack surface and the likelihood of exploitation. The impact extends to confidentiality if sensitive images are exposed or altered. Overall, the vulnerability threatens the integrity and availability of website assets, which can have cascading effects on business operations and customer trust.

Until an official patch is released, organizations should implement the following mitigations: 1) Restrict access to the WordPress admin and plugin management interfaces using IP whitelisting or VPNs to limit potential attackers. 2) Employ web application firewalls (WAFs) with custom rules to detect and block unauthorized requests targeting the image optimization endpoints. 3) Monitor logs for unusual activity related to image optimization functions to detect potential exploitation attempts early. 4) Temporarily disable or uninstall the 'Optimize More! – Images' plugin if image optimization is not critical, to eliminate the attack vector. 5) Keep WordPress core and all plugins updated regularly and subscribe to vendor advisories for timely patching. 6) Implement strict role-based access control (RBAC) within WordPress to minimize permissions for users and plugins. 7) Conduct security audits and penetration testing focused on plugin vulnerabilities to identify and remediate similar issues proactively.