Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-2450 EUVD-2022-34711GHSA-93hf-hv49-rhh9

reSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls

Published Nov 14, 2022 · Updated Apr 30, 2025 · Assigned by WPScan

Description

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.

Affected products

VendorProductAffectedFixed
— reSmush.it : the only free Image Optimizer & compress plugin 0.4.4 – < 0.4.4 0.4.4

References