Autoptimize CVE-2026-78471

Exploitation is gated by a conjunction of four non-default conditions that all must hold at once: (1) an administrator must have enabled Autoptimize's 'Lazy-load images?' option; (2) the file w3-total-cache/w3-total-cache.php must be present on disk while the W3 Total Cache plugin is DISABLED; (3) a class named Minify_HTML must be loaded into scope by some other plugin; and (4) a comment moderator must approve the attacker's comment before the payload renders. The payload itself is delivered via the Comment Author Name field, so comments must be open/accepted. The moderator-approval step and the stacked environmental prerequisites are strong limiting factors that make default WordPress+Autoptimize installations non-exploitable; only sites with this exact plugin/file combination are affected.

Despite a network attack vector (AV:N) and no authentication requirement (PR:N), this is a low-priority, high-friction vulnerability rather than a genuine emergency. The CVSS base score of 5.4 (Medium) is dominated by AC:H, which correctly reflects an exceptionally narrow precondition chain: the description requires FOUR independent conditions to align simultaneously - the admin must enable Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file must exist on disk while W3 Total Cache is disabled, a class named Minify_HTML must be loaded into scope by some other plugin, and a human moderator must approve the malicious comment before any payload renders. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AV:N/PR:N signals (which might suggest broad remote risk) are strongly contradicted by the AC:H conditions and the moderator-approval gate, meaning any real-world exploitation would be opportunistic and rare rather than widespread. Impact is limited (C:L/I:L/A:N) and is the typical stored-XSS outcome of script execution in a victim's browser. Net: a legitimate bug worth patching on the normal maintenance cycle, not an urgent fire.

An unauthenticated attacker submits a blog comment whose Author Name contains an XSS payload. If the site runs the specific vulnerable configuration (Autoptimize lazy-load enabled, the dormant W3TC file present, and a Minify_HTML class loaded by another plugin), and a moderator approves the comment, the unsanitized author name is emitted during lazy-load HTML processing and the script executes in the browser of any visitor who loads the page. No public exploit code was identified in the provided data.