The vulnerability identified as CVE-2026-25387 affects the Elementor Image Optimizer plugin (versions up to 1.7.1). It is classified as a missing authorization issue, meaning that the plugin fails to properly enforce access control checks. This allows users with limited privileges to perform actions that should be restricted, potentially impacting the availability of the service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and low availability impact.

The impact is limited to availability degradation due to missing authorization checks in the plugin. There is no confidentiality or integrity impact reported. The vulnerability requires low privileges and can be exploited remotely over the network. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the plugin's functionalities to trusted users only and consider disabling the plugin if feasible.