CVE-2026-90953: CWE-200 Information Exposure in Image Optimizer
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
AI Analysis
Technical Summary
CVE-2026-90953 is an information exposure vulnerability (CWE-200) in the Image Optimizer WordPress plugin versions prior to 1.7.7. The plugin fails to enforce intended capability checks on several read REST API endpoints, enabling any authenticated user to retrieve sensitive attachment metadata and site-wide statistics that are normally limited to administrator roles.
Potential Impact
Any authenticated user on a WordPress site using a vulnerable version of the Image Optimizer plugin can access sensitive information including attachment metadata and site-wide statistics. This exposure could aid attackers in reconnaissance or further attacks but does not directly allow privilege escalation or code execution.
Mitigation Recommendations
Upgrade the Image Optimizer plugin to version 1.7.7 or later where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary provided.
CVE-2026-90953: CWE-200 Information Exposure in Image Optimizer
Description
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
Affected software
Image Optimizer
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90953 is an information exposure vulnerability (CWE-200) in the Image Optimizer WordPress plugin versions prior to 1.7.7. The plugin fails to enforce intended capability checks on several read REST API endpoints, enabling any authenticated user to retrieve sensitive attachment metadata and site-wide statistics that are normally limited to administrator roles.
Potential Impact
Any authenticated user on a WordPress site using a vulnerable version of the Image Optimizer plugin can access sensitive information including attachment metadata and site-wide statistics. This exposure could aid attackers in reconnaissance or further attacks but does not directly allow privilege escalation or code execution.
Mitigation Recommendations
Upgrade the Image Optimizer plugin to version 1.7.7 or later where this vulnerability is fixed. No other mitigation is indicated. Patch status is confirmed by the version boundary provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-14T11:53:13.454Z
- State
- PUBLISHED
Threat ID: 6abcab01236a9c741f0494b9
Added to database: 09/30/2026, 06:24:01 UTC
Last enriched: 09/30/2026, 06:39:01 UTC
Last updated: 09/30/2026, 07:39:44 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.