# Nexter Extension <= 4.7.12 - Authenticated (Author+) Missing Authorization to Image Conversion and Overwrite via Image Optimisation

- **ID:** WPSEC-2026-1081
- **Plugin:** Nexter Extension – Security, Performance, Code Snippets & Site Toolkit (`nexter-extension`), https://wordpress.org/plugins/nexter-extension/
- **Affected versions:** from 4.6.0 before 4.7.13
- **Fixed in:** 4.7.13 (Update to 4.7.13 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nexter-extension
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1081/

## Description

The Nexter Extension plugin for WordPress is vulnerable to unauthorized modification of data via the Image Optimisation 'nxt_ext_image_convert_attachment' AJAX action in versions 4.6.0 to 4.7.12. This is due to the function checking only the upload_files capability and not checking that the user may edit the attachment being converted. This makes it possible for authenticated attackers with Author-level access and above to convert media library images that belong to other users, which replaces the files served for those images and rewrites their attachment metadata.

## References

- https://wpsec.com/vuln/WPSEC-2026-1081/
- https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.13/
- https://wordpress.org/plugins/nexter-extension/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1081/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.