What is the CVSS score of CVE-2026-2712?

CVE-2026-2712 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

PHP CVE-2026-2712

EUVD-2026-21254 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-10 Wordfence

WordPress PHP Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21254

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:24 nvd

MEDIUM 5.4

DescriptionCVE.org

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receive_heartbeat() function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking Updraft_Smush_Manager_Commands methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (updraft_smush_ajax) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (get_smush_logs), deleting all backup images (clean_all_backup_images), triggering bulk image processing (process_bulk_smush), and modifying Smush options (update_smush_options).

AnalysisAI

WP-Optimize plugin for WordPress allows authenticated subscribers and higher to execute admin-only operations including log file access, backup image deletion, and bulk image processing due to missing capability checks in the Heartbeat handler function. The vulnerability affects all versions up to 4.5.0 and requires user authentication but no elevated privileges, enabling privilege escalation from subscriber-level accounts to perform administrative image optimization tasks that should be restricted to site administrators.

Technical ContextAI

The vulnerability exists in the receive_heartbeat() function within includes/class-wp-optimize-heartbeat.php, which implements WordPress's Heartbeat API for periodic client-server communication. This handler directly invokes methods from the Updraft_Smush_Manager_Commands class without performing the security checks enforced by the standard AJAX handler updraft_smush_ajax. Specifically, the code bypasses three security layers: user capability verification, WordPress nonce token validation, and the whitelist of allowed commands. CWE-863 (Incorrect Authorization) classifies this as an authorization flaw where access control decisions are not properly implemented. The Heartbeat API is designed for authenticated users, but the missing checks in this specific handler allow any authenticated user-even those with minimal subscriber-level permissions-to invoke administrative functions intended only for site managers.

RemediationAI

Update the WP-Optimize plugin immediately to a patched version released after 4.5.0. Site administrators should upgrade through the WordPress admin dashboard (Plugins > Installed Plugins > WP-Optimize, then click Update if available) or manually download the latest version from plugins.wordpress.org/wp-optimize/. Pending patch availability, restrict plugin functionality by disabling the Heartbeat API for non-administrator users through server-side filtering or by using security plugins that enforce capability checks on AJAX handlers. Review WordPress user roles to ensure subscriber and contributor accounts are assigned only to trusted users; consider elevating critical image optimization tasks to administrator-only roles. Check Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/6a0a376e-ea3a-40ca-9341-f28f92e15e02 and the WordPress plugin repository change log for confirmation of patched versions.