CVE-2026-90953: Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Image Optimizer by Elementorto a version that resolves this vulnerability.Fixed in 1.7.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can access the affected read REST routes. This includes users with Subscriber-level access or higher; administrator privileges are not required.
What information may be exposed?
Affected routes can disclose attachment metadata and site-wide statistics that are intended to be restricted to administrators.
Which installations are affected?
Installations using Elementor Image Optimizer versions earlier than 1.7.7 are affected. The provided information does not identify any configuration prerequisite beyond having an authenticated user account.