Medium
4.3
The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to...
CVE-2025-11455
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| tigroumeow | Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF |
≤ 7.2.0 |
— |
Original description The description as published by the source.
The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web wordfence.com
- web plugins.trac.wordpress.org
- web nvd.nist.gov
- web github.com