CVE-2026-11784 is a CSRF vulnerability in the Optimole – Optimize Images plugin for WordPress, affecting all versions up to and including 4.2.6. The vulnerability is due to missing or incorrect nonce validation on the replace_file function. An attacker can exploit this by sending a forged multipart POST request that overwrites existing media attachments. Exploitation requires tricking a user with at least Author-level privileges who has edit_post capability on the targeted attachment to perform an action such as clicking a malicious link. This allows unauthorized modification of media files without authentication.

The vulnerability allows an unauthenticated attacker to overwrite media attachments that a victim user with Author-level or higher privileges can edit. This can lead to unauthorized modification of media content on the affected WordPress site. There is no direct confidentiality or availability impact reported, but the integrity of media files can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should limit the number of users with Author-level or higher privileges and exercise caution when clicking links from untrusted sources. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.