Image Watermark Vulnerability – Missing Authorization to Authenticated (Subscriber+) Watermark Modification – CVE-2024-1994 | WordPress Plugin Vulnerability Report

Plugin Name: Image Watermark

Key Information:

  • Software Type: Plugin
  • Software Slug: image-watermark
  • Software Status: Active
  • Software Author: dfactory
  • Software Downloads: 842,453
  • Active Installs: 50,000
  • Last Updated: April 10, 2024
  • Patched Versions: 1.7.4
  • Affected Versions: <= 1.7.3

Vulnerability Details:

  • Name: Image Watermark <= 1.7.3
  • Title: Missing Authorization to Authenticated (Subscriber+) Watermark Modification
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
  • CVE: CVE-2024-1994
  • CVSS Score: 4.3
  • Publicly Published: April 5, 2024
  • Researcher: Lucio Sá
  • Description: The Image Watermark plugin for WordPress, utilized widely for embedding watermarks on images, has been identified as having a critical vulnerability. This issue arises from a lack of adequate capability checks within the watermark_action_ajax() function, affecting all versions up to and including 1.7.3. Consequently, this flaw enables authenticated users, even those with just subscriber-level access, to manipulate watermarks on images, either applying or removing them without proper authorization.


The Image Watermark plugin harbors a significant security loophole in versions up to and including 1.7.3, where insufficient authorization checks allow even minimally privileged users to modify watermarks on images. This vulnerability, known as CVE-2024-1994, has been effectively addressed in the recently released patch, version 1.7.4.

Detailed Overview:

Discovered by cybersecurity expert Lucio Sá, this vulnerability's core lies in the inadequate security checks within a specific AJAX function of the plugin, leading to potential unauthorized data alteration. The ease of exploitation, given its low requirement for attacker privileges, marks a concerning oversight in the plugin's security architecture. The implications of such a vulnerability are manifold, ranging from copyright infringement issues due to unauthorized watermark removal to the potential for reputational damage for content creators relying on watermarks for image protection. The swift remediation in version 1.7.4 aims to fortify the plugin against such unauthorized access and alterations.

Advice for Users:

  • Immediate Action: All users of the Image Watermark plugin should promptly upgrade to the patched version 1.7.4 to safeguard their content against unauthorized modifications.
  • Check for Signs of Vulnerability: Regularly review your website's media files for any unexpected changes to watermarks, which could indicate exploitation of this vulnerability.
  • Alternate Plugins: Although the current issue has been addressed, users may consider exploring other watermarking plugins, especially those with a strong track record of security and regular updates, as a precautionary measure.
  • Stay Updated: Maintaining the latest versions of all WordPress plugins is essential to ensure the highest level of security and functionality for your website.


The proactive approach by the developers of Image Watermark in addressing CVE-2024-1994 reinforces the crucial role of ongoing vigilance and timely updates in the digital realm. For website administrators, particularly those managing content-heavy sites where image protection is paramount, ensuring the implementation of the latest plugin versions is indispensable for maintaining both security and copyright integrity.


Detailed Report:

In today's digital landscape, the security of your website is as crucial as the content it hosts. A stark reminder of this came with the recent discovery of a critical vulnerability in the "Image Watermark" WordPress plugin, known as CVE-2024-1994. This plugin, integral to countless websites for protecting image copyrights through watermarking, has been found susceptible to unauthorized watermark modifications due to insufficient security checks. This vulnerability not only highlights the risks of outdated software but also serves as a call to action for website owners to prioritize their digital defenses.

About the Plugin:

"Image Watermark," developed by dfactory, is a popular plugin with over 842,453 downloads and 50,000 active installations. It provides an essential service for content creators by allowing the addition of watermarks to images, thereby protecting intellectual property and deterring unauthorized use.

The Vulnerability:

CVE-2024-1994, identified by cybersecurity expert Lucio Sá, exposes a flaw in versions up to and including 1.7.3 of the plugin. This issue arises from a lack of proper capability checks within the watermark_action_ajax() function, enabling even users with minimal privileges, such as subscribers, to alter watermarks. The vulnerability has been publicly documented and carries a CVSS score of 4.3, signaling a moderate level of risk.

Risks and Potential Impacts:

The potential exploitation of this vulnerability could lead to widespread unauthorized removal or alteration of watermarks, undermining copyright protections and possibly leading to legal and financial repercussions for content creators. Additionally, it could erode trust in websites that rely on watermarking to assert ownership over their content.


In response, dfactory has released a patched version of the plugin, 1.7.4, which addresses this security gap. Users are urged to update immediately to safeguard their content. Regular monitoring of website media files for unexpected changes can also help in detecting any exploitation attempts.

Previous Vulnerabilities:

It's worth noting that this isn't the first time vulnerabilities have been found in WordPress plugins, "Image Watermark" included. Such instances underscore the importance of ongoing vigilance and the need for a proactive approach to website security.

For small business owners juggling numerous responsibilities, staying on top of every security update may seem daunting. However, the security of your website should not be compromised. Automated tools and managed WordPress hosting services can alleviate some of this burden by keeping your site updated and monitoring for security threats.


The discovery of CVE-2024-1994 serves as a critical reminder of the ever-evolving nature of cyber threats and the importance of maintaining up-to-date security measures. For small business owners, this highlights the need to view website security not as a one-time setup but as an ongoing commitment. Engaging with cybersecurity professionals or utilizing managed services can provide peace of mind and allow business owners to focus on their core operations, secure in the knowledge that their digital presence is protected.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Image Watermark Vulnerability – Missing Authorization to Authenticated (Subscriber+) Watermark Modification – CVE-2024-1994 | WordPress Plugin Vulnerability Report FAQS

Leave a Comment