CVE-2024-6631
📋 TL;DR
The ImageRecycle WordPress plugin has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to modify plugin settings without proper permissions. This affects all WordPress sites using ImageRecycle plugin versions up to 3.1.14. Attackers can change compression settings, potentially affecting site performance or functionality.
💻 Affected Systems
- ImageRecycle pdf & image compression WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could disable image compression entirely, causing site performance degradation, storage issues, or modify settings to redirect processed images to malicious servers.
Likely Case
Unauthorized users changing compression settings leading to poor image quality, increased bandwidth usage, or minor site functionality issues.
If Mitigated
With proper user role management and monitoring, impact is limited to settings changes that can be reverted by administrators.
🎯 Exploit Status
Exploitation requires authenticated access but uses simple AJAX requests that can be automated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.15
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins > Installed Plugins
3. Find ImageRecycle plugin
4. Click 'Update Now' if available
5. Or download version 3.1.15 from WordPress repository and manually update
🔧 Temporary Workarounds
Remove vulnerable plugin
allTemporarily deactivate or remove the ImageRecycle plugin until patched
wp plugin deactivate imagerecycle-pdf-image-compression
Restrict user roles
allLimit Subscriber and other low-privilege user accounts
🧯 If You Can't Patch
- Monitor WordPress AJAX logs for unauthorized plugin setting changes
- Implement web application firewall rules to block suspicious AJAX requests to ImageRecycle endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > ImageRecycle version. If version is 3.1.14 or lower, system is vulnerable.Check Version:
wp plugin get imagerecycle-pdf-image-compression --field=versionVerify Fix Applied:
Verify ImageRecycle plugin version is 3.1.15 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to ImageRecycle endpoints from non-admin users
- Multiple failed permission checks in WordPress debug logs
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with 'action' parameter containing 'imagerecycle_' from non-admin IPs
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "imagerecycle" AND NOT user_role="administrator"