blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-5821

HIGH 8.1 CVSS 3.1
Published
July 2, 2026
Last modified
October 28, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-73
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Description

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on their own attachments via WordPress's Custom Fields interface, injecting arbitrary absolute file paths into the backups array. When the attacker subsequently deletes the attachment, the plugin calls File_System::delete() on each path without validation. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server within the web server's filesystem permissions, potentially leading to denial of service, data loss, or security degradation.

Affected WordPress components

  • Image Optimization – Compress Images and Convert to WebP or AVIF Plugin · image-optimization
    Confirmed match Active
    Up to and including 1.7.4
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • elemntor Image Optimizer – Compress Images and Convert to WebP or AVIF — Up to and including 1.7.4

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/image-optimization/tags/1.7.3/classes/image/image-backup.php#L117
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/image-optimization/tags/1.7.3/classes/image/image-meta.php#L97
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/image-optimization/tags/1.7.3/modules/backups/components/handle-backups-removing.php#L19
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/image-optimization/trunk/classes/image/image-backup.php#L117
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/image-optimization/trunk/classes/image/image-meta.php#L97
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/image-optimization/trunk/modules/backups/components/handle-backups-removing.php#L19
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3557772%40image-optimization&new=3557772%40image-optimization&sfp_email=&sfph_mail=
  • research.cleantalk.org https://research.cleantalk.org/cve-2026-5821
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a00374-e9d6-46f9-a28c-cb7768505787?source=cve
  • nvd.nist.gov Official NVD record