Main Vulnerability Database Vulnerabilities #VU96567

Improper Authorization in ImageRecycle pdf & image compression - CVE-2024-6631

Published: August 27, 2024

Vulnerability identifier: #VU96567

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-6631

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a missing capability check on several AJAX actions. A remote user can perform unauthorized actions, such as updating plugin settings.

Affected software

ImageRecycle pdf & image compression

How to mitigate CVE-2024-6631

Install updates from vendor's website.

ImageRecycle pdf & image compression - update to 3.1.15

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/f330bf36-0a39-40d6-a075-c87fdb9dc2da?source=cve
https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php

Related Security Bulletins