PT-2025-51816 · WordPress · Converter For Media+1

Marcin Dudek · Published 2025-12-17 · Updated 2025-12-17 · CVE-2025-13750

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions up to and including 6.3.2

Description The plugin is susceptible to unauthorized data modification because of a missing capability check on the /webp-converter/v1/regenerate-attachment REST endpoint. This allows authenticated attackers with Subscriber-level access or higher to delete optimized WebP/AVIF variants for any attachment. The affected API endpoint is /webp-converter/v1/regenerate-attachment.

Recommendations Versions prior to and including 6.3.2 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13750

Affected Products

Converter For Media

Converter For Media – Optimize Images

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13750 · Security Note
• https://twitter.com/VulmonFeeds/status/2001239806924189743 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9a31190f-e2ed-46ee-a224-85a0a003738d?source=cve · Note
• https://t.me/CVEtracker/40037 · Telegram Post
• https://t.me/cveNotify/146062 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3414745/webp-converter-for-media · Note
• https://twitter.com/CVEnew/status/2001350819447554077 · Twitter Post