CVE-2026-25387: 
WordPress vulnerability analysis and mitigation

CVE-2026-25387 is a Missing Authorization (Broken Access Control) vulnerability in the Image Optimizer by Elementor WordPress plugin. It affects all versions from n/a through 1.7.1, allowing authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. This allows a low-privileged authenticated attacker to interact with restricted plugin functionality via network-accessible endpoints without proper authorization checks. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity (Feedly).

Successful exploitation results in a limited availability impact — an authenticated attacker with low privileges can trigger unauthorized actions within the plugin, potentially disrupting image optimization operations on the affected WordPress site. There is no confidentiality or integrity impact identified, and the scope remains unchanged, limiting the blast radius to the affected plugin's functionality (Feedly).

The EPSS score for CVE-2026-25387 is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the wild at this time. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Users should update the Image Optimizer by Elementor plugin to a version beyond 1.7.1 as soon as a patched release is made available by the vendor. In the interim, site administrators should restrict plugin access to trusted roles only and monitor for unexpected plugin activity. Disabling the plugin until a patch is applied is a viable precautionary measure for high-security environments (Feedly, Patchstack).

The vulnerability was noted in Sucuri's February 2026 vulnerability patch roundup, indicating it received routine coverage as part of the broader WordPress plugin security landscape. No significant vendor statements or notable researcher commentary beyond standard disclosure have been identified (Sucuri Blog).