EUVD-2026-41247
GHSA-rhv9-h5xx-r8m5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Exploited over the network via the WP dashboard (AV:N/AC:L), but requires Author-level auth (PR:L); file deletion yields high integrity and availability impact with no confidentiality loss.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on their own attachments via WordPress's Custom Fields interface, injecting arbitrary absolute file paths into the backups array. When the attacker subsequently deletes the attachment, the plugin calls File_System::delete() on each path without validation. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server within the web server's filesystem permissions, potentially leading to denial of service, data loss, or security degradation.
AnalysisAI
Arbitrary file deletion in the Image Optimizer plugin for WordPress (versions up to and including 1.7.4) lets an authenticated attacker with Author-level access or higher delete any file the web server can write to, potentially causing denial of service, data loss, or removal of security-relevant files such as wp-config.php. The flaw stems from the plugin trusting attacker-controllable backup paths stored in post meta. This was reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The vulnerability is a CWE-73 (External Control of File Name or Path) issue in the plugin's backup-cleanup logic. The plugin persists backup file paths in the image_optimizer_metadata post meta field and, in Image_Backup::remove() (classes/image/image-backup.php:117), passes those stored paths directly to File_System::delete() when the WordPress delete_attachment hook fires (modules/backups/components/handle-backups-removing.php:19). Because WordPress exposes post meta editing through the built-in Custom Fields interface, an Author can overwrite the backups array with arbitrary absolute paths. The missing control is a validation step confirming each path resolves within the WordPress uploads directory before deletion; without it, any path the process can reach is fair game, bounded only by the web server user's filesystem permissions.
RemediationAI
Upstream fix available (changeset 3557772 on the image-optimization repository); a released patched version was not explicitly stated in the input but corresponds to the release following 1.7.4, so administrators should update the Image Optimizer plugin to the latest available version (later than 1.7.4) once confirmed against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a00374-e9d6-46f9-a28c-cb7768505787 and the plugin changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3557772%40image-optimization&new=3557772%40image-optimization. Until patched, the most effective compensating control is to restrict who holds Author-level or higher roles - audit and demote untrusted accounts to Contributor or Subscriber, which cannot edit attachment post meta (trade-off: legitimate authors lose media-management ability). As a secondary control, deploy a security plugin or mu-plugin that restricts or disables the Custom Fields meta-box editing of image_optimizer_metadata, or run a WAF rule to flag post-meta writes containing absolute paths; note these are brittle and can break legitimate metadata workflows. Deactivating the Image Optimizer plugin entirely removes the exposure at the cost of losing image optimization functionality.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today