What is the CVSS score of CVE-2026-7252?

CVE-2026-7252 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WP-Optimize are affected by CVE-2026-7252?

WP-Optimize plugin versions 4.5.2 and earlier contain a critical file deletion vulnerability that allows authenticated WordPress Authors to delete essential server files, including wp-config.php,…

How to fix or mitigate CVE-2026-7252?

Within 24 hours: Audit all WordPress installations for WP-Optimize plugin presence and current version via admin dashboard or WP-CLI (wp plugin list). For any instance running version ≤4.5.2, immediately restrict Author-level user accounts to essential personnel only and review recent user activity logs for suspicious file operations. Within 7 days: Contact WP-Optimize developers or monitor their security advisories for patch availability; if unavailable, disable the plugin entirely (wp plugin deactivate wp-optimize) and document business justification for any continued use pending patch release. Within 30 days: Implement an alternative optimization solution after patch availability is confirmed, or maintain deactivated status with compensating monitoring controls in place.

WP-Optimize CVE-2026-7252

EUVD-2026-28323 HIGH

Path Traversal (CWE-22)

2026-05-07 Wordfence

GHSA-p78j-pm32-q3pf

PHP RCE WordPress Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 05:46 vuln.today

CVE Published

May 07, 2026 - 04:27 nvd

HIGH 8.1

DescriptionCVE.org

The WP-Optimize - Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key - it does not begin with an underscore - allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.

AnalysisAI

Arbitrary file deletion in WP-Optimize plugin versions ≤4.5.2 allows authenticated attackers with Author-level privileges to delete critical server files including wp-config.php, enabling remote code execution. The vulnerability exploits insufficient path validation in the unscheduled_original_file_deletion function combined with the non-protected 'original-file' meta key that Authors can manipulate via WordPress's Edit Media form or REST API. Wordfence discovered this CWE-22 path traversal flaw affecting the popular WordPress optimization plugin used on hundreds of thousands of sites.

Technical ContextAI

This is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability in the WP-Optimize plugin's image compression module. The class-updraft-smush-manager.php file implements an unscheduled_original_file_deletion function that accepts file paths from the 'original-file' post meta field without adequate sanitization. In WordPress, meta keys beginning with an underscore are protected and only editable by administrators, but 'original-file' lacks this prefix, making it a public meta key. This design flaw allows Author-level users (who have create_posts and edit_posts capabilities but should have restricted server access) to set arbitrary file paths on attachment posts they control. When the deletion function processes these manipulated meta values, it performs unlink() operations on attacker-controlled paths, enabling directory traversal attacks to delete files anywhere the web server process has write permissions.

RemediationAI

Upgrade immediately to WP-Optimize version 4.5.3 or later, which addresses the path traversal vulnerability through improved file path validation in class-updraft-smush-manager.php (changeset 3518513 available at https://plugins.trac.wordpress.org/changeset/3518513/wp-optimize/trunk/includes/class-updraft-smush-manager.php). The fix can be applied through the WordPress admin dashboard under Plugins → Updates or by downloading from the official WordPress plugin repository. If immediate patching is not possible, implement these compensating controls: (1) Temporarily revoke Author-level access for all non-essential user accounts and audit recent Author account activity for suspicious attachment uploads or metadata modifications via wp_postmeta table inspection; (2) Implement file integrity monitoring (FIM) on critical WordPress files (wp-config.php, .htaccess, index.php, wp-load.php) to detect unauthorized deletion attempts; (3) Configure web application firewall (WAF) rules to block REST API requests from Author-level accounts to attachment endpoints containing suspicious file path patterns in metadata; (4) Review WordPress filesystem permissions to ensure the web server process cannot delete critical configuration files outside the wp-content/uploads directory. Note that disabling the plugin entirely eliminates the vulnerability but removes caching and optimization functionality, potentially impacting site performance.