CVE-2026-125834: WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.3.5
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). The available information does not identify the specific WordPress role or capability required.
Can this be exploited remotely without user interaction?
Yes. The CVSS vector lists network attack access (AV:N), low attack complexity (AC:L), and no user interaction requirement (UI:N).
What is the likely impact if the vulnerability is exploited?
The reported impact is limited to confidentiality (C:L). No integrity or availability impact is indicated.
Which Imagify versions are affected?
Imagify versions through 2.3.4 are affected. The lower bound is not specified in the available information.