vulnerability

WordPress Plugin: resmushit-image-optimizer: CVE-2022-2450: Missing Authorization

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Aug 11, 2022

Added

May 15, 2025

Modified

Apr 30, 2026

Description

The reSmush.it plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several AJAX actions in versions up to, and including, 0.4.3 . This makes it possible for unauthenticated attackers to download the logs of the plugin which can contain sensitive information.

Solution

resmushit-image-optimizer-plugin-cve-2022-2450

References

https://www.cve.org/CVERecord?id=CVE-2022-2450
https://www.wordfence.com/threat-intel/vulnerabilities/id/9c4e5c12-6f12-40cb-ac0a-389ad3715503?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34711
CVE-2022-2450
https://attackerkb.com/topics/CVE-2022-2450
CWE-862
EUVD-EUVD-2022-34711

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report