CVE-2025-11519

Executive Summary

CVE-2025-11519 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in the Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization WordPress plugin, affecting all versions up to and including 4.1.0. The flaw resides in the /wp-json/optml/v1/move_image REST API endpoint, where a user-controlled key is not properly validated. This allows authenticated attackers with Author-level access or higher to offload (move) media files that do not belong to them, potentially leading to unauthorized data exfiltration or disruption of media management.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve Apache or Nginx server software. The plugin is widely used for image optimization and CDN delivery, making this a significant supply chain risk for WordPress sites.

Supply Chain & Package Security

This vulnerability affects the Optimole WordPress plugin, which is distributed through the official WordPress plugin repository. The plugin is a third-party component that integrates deeply with WordPress media handling. The lack of a patch at the time of analysis means that all sites using Optimole versions 4.1.0 and below are exposed. Administrators should monitor the plugin's update channel and consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level WordPress user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (unauthorized access to media metadata)
• Integrity Impact: None
• Availability Impact: None

The medium severity reflects the requirement for authentication and the limited impact on confidentiality. However, the ability to offload arbitrary media could lead to data leakage or disruption of media workflows.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the REST API endpoint /wp-json/optml/v1/move_image. This endpoint is intended to allow authorized users to move (offload) images from the WordPress server to the Optimole CDN. The endpoint accepts a user-controlled key (likely a media attachment ID or similar identifier) to specify which image to move.

The flaw is that the plugin fails to verify that the authenticated user owns or has permission to modify the specified media attachment. WordPress's built-in media permissions are bypassed, allowing an Author-level user to move any media file on the site, including those uploaded by other users (e.g., Administrators or Editors).

The attack flow:

1. An attacker authenticates as a user with Author-level privileges.
2. The attacker crafts a POST request to /wp-json/optml/v1/move_image with a manipulated key parameter pointing to a target media ID.
3. The plugin processes the request without checking ownership, moving the target media to the Optimole CDN.
4. The attacker can then potentially access the offloaded media via the CDN, or disrupt the original media URL.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the REST API callback function. A typical vulnerable pattern would be:

// Vulnerable code (conceptual)
register_rest_route('optml/v1', '/move_image', array(
    'methods' => 'POST',
    'callback' => 'optml_move_image',
    'permission_callback' => function() { return current_user_can('edit_posts'); }
));

function optml_move_image($request) {
    $attachment_id = $request->get_param('key');
    // Missing ownership check
    $attachment = get_post($attachment_id);
    // Process move...
}

A patched version would include an ownership verification:

// Patched code (conceptual)
function optml_move_image($request) {
    $attachment_id = $request->get_param('key');
    $attachment = get_post($attachment_id);
    if (!$attachment || $attachment->post_author != get_current_user_id()) {
        return new WP_Error('forbidden', 'You do not own this media.', array('status' => 403));
    }
    // Process move...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Optimole plugin version <= 4.1.0.
• An authenticated user account with Author-level privileges.
• Knowledge of a target media attachment ID (e.g., obtained via directory enumeration or other means).

Exploitation Steps:

1. Identify Target Media ID: Use WordPress REST API to list media:

   curl -s -X GET "http://target/wp-json/wp/v2/media" -H "Authorization: Bearer <token>" | jq '.[].id'
   

2. Craft Exploit Request: Send a POST request to the vulnerable endpoint with the target media ID:

   curl -X POST "http://target/wp-json/optml/v1/move_image" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer <token>" \
     -d '{"key": 123}'
   

3. Verify Exploitation: Check if the media is now offloaded to Optimole CDN by inspecting the media URL or checking the plugin's logs.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor REST API logs for unusual POST requests to /wp-json/optml/v1/move_image from non-Administrator users.
• Alert on multiple rapid requests to the same endpoint with varying key parameters.
• Check for media ownership mismatches after offload operations.

Hunting:

• Search for HTTP 200 responses from the endpoint with Author-level user agents.
• Correlate media offload events with user roles.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-json/optml/v1/move_image with JSON body containing "key" parameter.
  • Source IP addresses of authenticated Author users making such requests.
• Host:
  • WordPress debug logs showing optml_move_image function calls with unexpected attachment IDs.
  • Media library entries where post_author does not match the user who triggered the offload.
• File:
  • Modified or missing media files in the WordPress uploads directory after offload.

Detection Engineering

YARA Rule

rule CVE_2025_11519_Optimole_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11519 in Optimole plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11519"
    strings:
        $endpoint = "/wp-json/optml/v1/move_image"
        $key_param = "\"key\":"
    condition:
        $endpoint and $key_param
}

Sigma Rule

title: CVE-2025-11519 Optimole IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to the vulnerable Optimole REST API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: "/wp-json/optml/v1/move_image"
    condition: selection
falsepositives:
    - Legitimate admin operations
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11519 Optimole IDOR Exploitation"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-json/optml/v1/move_image"; http.request_body; content:"\"key\":"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Optimole plugin until a patched version is released.
2. Restrict Author-level user permissions to prevent exploitation if the plugin must remain active.
3. Monitor REST API logs for suspicious activity targeting the vulnerable endpoint.

Long-term Fix:

• Apply the official patch once released by the vendor.
• Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-json/optml/v1/move_image from non-Administrator users.
• Regularly audit WordPress user roles and capabilities.

Workaround:

• Use a plugin like "User Role Editor" to remove the edit_posts capability from Author roles, but this may break legitimate functionality.

Valters IT