PT-2024-39595 · WordPress · Bulk Images Optimizer

🗓️ 17 Oct 2024 00:00:00Reported by Positive TechnologiesType

Bulk Images Optimizer plugin for WordPress up to version 2.0.1 has a missing capability check, enabling Subscriber or higher to modify options.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-9361	18 Oct 202407:42	–	circl
CNNVD	WordPress plugin Bulk images optimizer 安全漏洞	18 Oct 202400:00	–	cnnvd
CVE	CVE-2024-9361	18 Oct 202404:32	–	cve
Cvelist	CVE-2024-9361 Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update	18 Oct 202404:32	–	cvelist
EUVD	EUVD-2024-49886	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9361	18 Oct 202405:15	–	nvd
Patchstack	WordPress Bulk images optimizer Plugin <= 2.0.1 is vulnerable to Broken Access Control	17 Oct 202400:00	–	patchstack
Patchstack	WordPress Bulk images optimizer plugin <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update vulnerability	17 Oct 202418:01	–	patchstack
RedhatCVE	CVE-2024-9361	23 May 202508:15	–	redhatcve
Vulnrichment	CVE-2024-9361 Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update	18 Oct 202404:32	–	vulnrichment

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-9361
t	www.t.me/cvenotify/100330
twitter	www.twitter.com/CVEnew/status/1847136622120411185
plugins	www.plugins.trac.wordpress.org/browser/bulk-image-resizer/trunk/includes/class-bir-loader.php
t	www.t.me/cvedetector/8280
twitter	www.twitter.com/UndercodeNews/status/1852495794646991109
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a189e436-e8af-4379-aa6e-2d1a4a2d4bfa
cve	www.cve.mitre.org/cgi-bin/cvename.cgi

01 Nov 2024 00:00Current

7High risk

Vulners AI Score7

CVSS 3.14.3

EPSS0.00188

SSVC