CVE-2025-67624: 
WordPress vulnerability analysis and mitigation

CVE-2025-67624 is a Missing Authorization vulnerability in the WordPress plugin "Optimize More! – Images" (optimize-more-images) developed by Arya Dhiratara. The flaw allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting all versions from n/a through 1.1.3. It was published on February 20, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly).

The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. This allows network-based attackers with no privileges or user interaction required to access restricted functionality. The attack vector is network-accessible, with low complexity, resulting in limited confidentiality and availability impacts (Feedly).

Successful exploitation can result in unauthorized access to restricted plugin functionality, leading to limited information disclosure (low confidentiality impact) and minor disruption to availability. Integrity is not directly impacted. The scope is unchanged, meaning exploitation is confined to the vulnerable component without lateral movement to other systems (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67624. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update the "Optimize More! – Images" WordPress plugin to a version beyond 1.1.3 if a patched release is available from the plugin author Arya Dhiratara. If no patch is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Restricting access to WordPress admin and plugin endpoints via web application firewall (WAF) rules can serve as an interim mitigation (Feedly, Wordfence).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the period of February 2–8, 2026, as part of routine tracking of WordPress plugin security issues. No significant independent researcher commentary or broader media coverage has been identified (Wordfence).