Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more <= 4.6.4 - Authenticated (Subscriber+) Missing Authorization to Image Preset Creation, Modification, and Deletion
- ID
- WPSEC-2026-1773
- Plugin
- Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more (ilab-media-tools)
- Affected
- all versions before 4.7.2
- Remediation
- Update to 4.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more on WPSec AttackSurface
- Fix released
- Published
Description
The Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more plugin for WordPress is vulnerable to unauthorized modification of data via the image preset AJAX actions (ilab_dynamic_images_new_preset, ilab_dynamic_images_save_preset and ilab_dynamic_images_delete_preset) in all versions up to, and including, 4.6.4, due to a missing capability check and missing nonce verification in the newPreset(), savePreset() and deletePreset() functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, overwrite or delete the site's Dynamic Images (Imgix) image-editing presets, including the default presets applied to image sizes across the site, when the Dynamic Images feature is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1773/
- https://plugins.svn.wordpress.org/ilab-media-tools/tags/4.7.2/
- https://wordpress.org/plugins/ilab-media-tools/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS