W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution

/**
 * File: Extension_ImageService_Plugin_Admin.php @ 2.9.1
 */

	public function ajax_submit() {
		check_ajax_referer( 'w3tc_imageservice_submit' );

		// Check WP_Filesystem credentials.
		Util_WpFile::ajax_check_credentials(
			sprintf(
				// translators: 1: HTML achor open tag, 2: HTML anchor close tag.
				__( '%1$sLearn more%2$s.', 'w3-total-cache' ),
				'<a target="_blank" href="' . esc_url(
					'https://www.boldgrid.com/support/w3-total-cache/image-service/?utm_source=w3tc&utm_medium=conversion_error&utm_campaign=imageservice#unable-to-connect-to-the-filesystem-error'
				) . '">',
				'</a>'
			)
		);

		// Check for post id.
		$post_id_val = Util_Request::get_integer( 'post_id' );
		$post_id     = ! empty( $post_id_val ) ? $post_id_val : null;

		if ( ! $post_id ) {
			wp_send_json_error(
				array(
					'error' => __( 'Missing post id.', 'w3-total-cache' ),
				)
			);
		}

--- 

	public function ajax_get_postmeta() {
		check_ajax_referer( 'w3tc_imageservice_submit' );

		// Check for post id.
		$post_id_val = Util_Request::get_integer( 'post_id' );
		$post_id     = ! empty( $post_id_val ) ? $post_id_val : null;

		if ( $post_id ) {
			wp_send_json_success( (array) get_post_meta( $post_id, 'w3tc_imageservice', true ) );
		} else {
			wp_send_json_error(
				array(
					'error' => __( 'Missing post id.', 'w3-total-cache' ),
				)
			);
		}
	}

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/w3-total-cache/2.9.1/Extension_ImageService_Plugin_Admin.php /home/deploy/wp-safety.org/data/plugin-versions/w3-total-cache/2.9.2/Extension_ImageService_Plugin_Admin.php
--- /home/deploy/wp-safety.org/data/plugin-versions/w3-total-cache/2.9.1/Extension_ImageService_Plugin_Admin.php	2026-01-15 23:28:22.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/w3-total-cache/2.9.2/Extension_ImageService_Plugin_Admin.php	2026-03-05 20:54:08.000000000 +0000
@@ -1791,6 +1802,27 @@
 			);
 		}
 
+		if ( ! current_user_can( 'edit_post', $post_id ) ) {
+			wp_send_json_error(
+				array(
+					'error' => __( 'You do not have permission to convert this image.', 'w3-total-cache' ),
+				),
+				403
+			);
+		}
+
+		// Check WP_Filesystem credentials.
+		Util_WpFile::ajax_check_credentials(
+			sprintf(
+				// translators: 1: HTML anchor open tag, 2: HTML anchor close tag.
+				__( '%1$sLearn more%2$s.', 'w3-total-cache' ),
+				'<a target="_blank" href="' . esc_url(
+					'https://www.boldgrid.com/support/w3-total-cache/image-service/?utm_source=w3tc&utm_medium=conversion_error&utm_campaign=imageservice#unable-to-connect-to-the-filesystem-error'
+				) . '">',
+				'</a>'
+			)
+		);
+
 		global $wp_filesystem;
 
 		// Verify the image file exists.
@@ -1981,6 +2013,16 @@
 		$post_id     = ! empty( $post_id_val ) ? $post_id_val : null;
 
 		if ( $post_id ) {
+			if ( ! current_user_can( 'edit_post', $post_id ) ) {
+				wp_send_json_error(
+					array(
+						'error' => __( 'You do not have permission to access this image.', 'w3-total-cache' ),
+					),
+					403
+				);
+				return;
+			}
+
 			wp_send_json_success( (array) get_post_meta( $post_id, 'w3tc_imageservice', true ) );
 		} else {
 			wp_send_json_error(