{"affected":[{"defaultStatus":"unaffected","product":"Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF","source":"CNA: Wordfence","vendor":"tigroumeow","versions":[{"lessThanOrEqual":"7.2.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2025-11455","cwes":["CWE-862"],"description":"The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access and above, to replace files that do not belong to them.","epss":{"date":"2026-11-02","percentile":0.08914,"score":0.00192},"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":4.3,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793636359997,"publishedAt":1793432810870,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb730d0-1394-4716-bddd-efa55d6e4bf3?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?old_path=/wp-retina-2x/tags/7.2.0&new_path=/wp-retina-2x/tags/7.2.1"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?old_path=/wp-retina-2x/tags/7.2.0&new_path=/wp-retina-2x/tags/7.2.1"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adb730d0-1394-4716-bddd-efa55d6e4bf3?source=cve"}],"remediation":[],"revision":"c61a57bfc6f17382dd6efd95ef5e80ff86430084c91974aee4ce287eb05e8787","sources":[{"modifiedAt":1793634818422,"name":"CNA: Wordfence","retrievedAt":1793639300824,"url":"https://www.cve.org/CVERecord?id=CVE-2025-11455"},{"modifiedAt":1793636359997,"name":"NVD","retrievedAt":1793643493013,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11455"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793635728713,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11455"}],"ssvc":{"assessedAt":1793634808103,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement","updatedAt":1793643493013}