Security Alert Summary
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress contains a missing capability check on a REST endpoint that allows authenticated users with Subscriber-level access and above to delete optimized WebP/AVIF variants for arbitrary attachments. This can result in loss of optimized image files and degraded site media performance.
CVE Details
- CVE ID: CVE-2025-13750
- Affected component: The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress
- Affected versions: All versions up to and including 6.3.2
- Published: December 17, 2025 at 7:15:58 AM UTC
- Last modified: December 17, 2025 at 7:15:58 AM UTC
- CVSS v3.1: Base Score 4.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: Requires an authenticated user; attacker privileges: Subscriber-level (LOW); user interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
- Fixed version: Not specified in the CVE entry
Technical Details
The vulnerability exists because a capability check is missing on the plugin’s REST API endpoint /webp-converter/v1/regenerate-attachment. Without that authorization check, authenticated users with minimal privileges (Subscriber-level and above) can invoke the endpoint to delete optimized WebP and AVIF variants associated with arbitrary attachment IDs.
In practical terms, the plugin permits authenticated requests to trigger deletion of generated image variants without verifying that the requesting user has the appropriate capability to manage or modify the targeted attachment. The CVE description specifically identifies the missing capability check on the named REST endpoint as the cause.
How This Could Impact Your Website
Consider a small site with a site owner, an internal content editor, and an external contributor. If the external contributor (or another authenticated user with Subscriber-level access) can call the vulnerable endpoint, they could delete optimized WebP/AVIF variants for attachments used throughout the site. That can lead to:
- Broken or missing images where optimized variants are expected (thumbnails, responsive images), affecting site appearance and user experience.
- Degraded performance and increased bandwidth usage if the site falls back to serving larger original images instead of optimized variants.
- Additional administrative work to regenerate or restore image variants and verify media integrity across pages.
This issue does not indicate exposure of sensitive user data, but it can disrupt media delivery and site operations. professional review may be useful if you’re unsure whether your site is affected or how to assess your current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (fixed version not specified in the CVE entry).
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other non-editorial accounts.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior related to media modification or REST API calls.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
