WordPress Plugin Vulnerabilities

Image Optimizer < 1.7.5 - Author+ Arbitrary File Deletion via Post Meta Field Injection

Description

The plugin does not validate backup file paths stored in attachment post meta before deleting them, allowing authenticated attackers with Author-level access and above to inject arbitrary absolute paths and delete arbitrary files on the server, potentially leading to denial of service or data loss.

Affects Plugins

Plugin icon
image-optimization
Fixed in 1.7.5

References

CVE
CVE-2026-5821
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a00374-e9d6-46f9-a28c-cb7768505787

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
6.5 (Medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Verified
No
WPVDB ID
b5bfc8c2-cad7-4bc9-8872-935c175f08aa

Timeline

Publicly Published
2026-07-01 (about 1 month ago)
Added
2026-07-01 (about 1 month ago)
Last Updated
2026-07-01 (about 1 month ago)

Other

Published
Title
Published
2025-08-14
Title
Icons Factory <= 1.6.12 - Unauthenticated Arbitrary File Deletion
Published
2025-02-28
Title
Simple Download Counter < 2.1 - Authenticated (Author+) Arbitrary File Read
Published
2023-10-19
Title
AI ChatBot < 4.9.3 - Subscriber+ Arbitrary File Deletion
Published
2025-05-16
Title
WPBot Pro Wordpress Chatbot < 13.7.0 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2025-10-07
Title
Motors – Car Dealership & Classified Listings Plugin < 1.4.90 - Authenticated (Subscriber+) Arbitrary File Deletion