Live › vulnerability › CVE-2025-11455
The Perfect Images plugin for WordPress exposes a REST endpoint that skips a capability check, so it does not verify who is calling it. An authenticated user with Author-level access or higher can replace files that belong to other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 08:34 UTC. All times on this page are UTC.
Sites running the Perfect Images plugin for WordPress at version 7.2.0 or earlier, where users have Author-level accounts or higher. The flaw needs a logged-in account, so sites that only have administrators or no user accounts are less exposed. The sources do not state a fixed version.
No product ranges from the sources yet.
wp-content/plugins/wp-retina-2x/ on the server.7.2.0 is in use.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.
This page as .md · .json · in your agent: get_signal("CVE-2025-11455")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.