# Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more <= 4.6.4 - Authenticated (Subscriber+) Missing Authorization to Image Preset Creation, Modification, and Deletion

- **ID:** WPSEC-2026-1773
- **Plugin:** Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more (`ilab-media-tools`), https://wordpress.org/plugins/ilab-media-tools/
- **Affected versions:** all versions before 4.7.2
- **Fixed in:** 4.7.2 (Update to 4.7.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ilab-media-tools
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1773/

## Description

The Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more plugin for WordPress is vulnerable to unauthorized modification of data via the image preset AJAX actions (ilab_dynamic_images_new_preset, ilab_dynamic_images_save_preset and ilab_dynamic_images_delete_preset) in all versions up to, and including, 4.6.4, due to a missing capability check and missing nonce verification in the newPreset(), savePreset() and deletePreset() functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, overwrite or delete the site's Dynamic Images (Imgix) image-editing presets, including the default presets applied to image sizes across the site, when the Dynamic Images feature is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1773/
- https://plugins.svn.wordpress.org/ilab-media-tools/tags/4.7.2/
- https://wordpress.org/plugins/ilab-media-tools/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1773/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.