CVE-2026-11784

🗓️ 18 Jun 2026 05:34:25Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Cross-site request forgery in Optimole up to 4.2.6 enables overwriting media via replace_file without nonce validation.

Reporter	Title	Published	Views	Family All 8
GithubExploit	Exploit for CVE-2026-11784	19 Jun 202613:49	–	githubexploit
ATTACKERKB	CVE-2026-11784	18 Jun 202605:34	–	attackerkb
Cvelist	CVE-2026-11784 Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action	18 Jun 202605:34	–	cvelist
EUVD	EUVD-2026-37848	18 Jun 202605:34	–	euvd
NVD	CVE-2026-11784	18 Jun 202606:16	–	nvd
Patchstack	WordPress Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization plugin <= 4.2.6 - Cross-Site Request Forgery vulnerability	17 Jun 202600:00	–	patchstack
Positive Technologies	PT-2026-50629	18 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-11784 Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action	18 Jun 202605:34	–	vulnrichment

Vulners

Node

optimole optimole_optimize_images_|_convert_webp_&_avif_|_cdn_&_lazy_load_|_image_optimizationRange≤4.2.6wordpress

[
  {
    "vendor": "optimole",
    "product": "Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.2.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php
plugins	www.plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php
plugins	www.plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad
plugins	www.plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	CSRF to arbitrary file overwrite in Optimole plugin via missing nonce verification on wp_ajax_optml_replace_file causing unauthenticated attackers to overwrite media attachments.	CWE-352
attachment_id	request body	/wp-admin/admin-ajax.php	CSRF to arbitrary file overwrite in Optimole plugin via missing nonce verification on wp_ajax_optml_replace_file causing unauthenticated attackers to overwrite media attachments.	CWE-352
file	request body	/wp-admin/admin-ajax.php	CSRF to arbitrary file overwrite in Optimole plugin via missing nonce verification on wp_ajax_optml_replace_file causing unauthenticated attackers to overwrite media attachments.	CWE-352

18 Jun 2026 15:23Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.14.3

EPSS0.00157

SSVC

CWE-352