WP-Optimize CVE-2026-7252

Exploitation requires the attacker to possess WordPress Author-level credentials or higher on the target site. The WP-Optimize plugin version 4.5.2 or earlier must be installed and active. The web server process (typically www-data, apache, or nginx user) must have write permissions to the target files for deletion, which is standard for wp-config.php and other WordPress core files in typical installations. The vulnerability is exploitable through either the standard WordPress Edit Media interface or the REST API (/wp-json/wp/v2/media endpoints), both of which allow Authors to modify post metadata on their own attachment posts. No special plugin configuration is required-default WP-Optimize settings are vulnerable. The attack is not limited by WordPress Multisite restrictions or specific hosting configurations, making it broadly exploitable across diverse WordPress deployments.

This represents a critical real-world risk despite the 8.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable with low complexity requiring only low privileges (Author-level). Author accounts are commonly created on WordPress sites for content contributors, making the privilege barrier lower than typical high-CVSS vulnerabilities requiring administrative access. The attack chain from arbitrary file deletion to remote code execution is well-established: deleting wp-config.php triggers WordPress installation mode, allowing attackers to reconfigure the database and gain admin access, or deleting .htaccess files can enable execution of uploaded malicious files. The vulnerability's severity is amplified by WP-Optimize's popularity (600,000+ active installations per WordPress.org statistics) and the fact that Author-level access is frequently granted to external contributors, contractors, or compromised accounts. While no EPSS data or KEV status is provided, the technical simplicity (AC:L), the attacker-favorable privilege requirement (common Author accounts rather than admin-only), and the clear path to RCE make this a genuine priority for WordPress administrators. The vulnerability affects all versions through 4.5.2, and the changeset reference indicates a patch exists in 4.5.3, providing a clear remediation path.

An attacker with Author credentials (obtained through credential stuffing, social engineering, or compromised contributor account) logs into the WordPress admin panel and uploads a benign image file, creating an attachment post. Using the Edit Media form or a crafted REST API request to /wp-json/wp/v2/media/{id}, the attacker modifies the 'original-file' post meta field to contain a path traversal payload such as '../../../wp-config.php'. When WP-Optimize's image compression cleanup routine executes the unscheduled_original_file_deletion function, it processes the malicious path and deletes wp-config.php. With the configuration file removed, the attacker visits the site to trigger WordPress installation mode, configures a new database connection under their control, and gains administrative access to execute arbitrary PHP code through theme editors or plugin uploads.