PHP EUVD-2026-21254

The CVSS 3.1 score of 5.4 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L correctly reflects a moderate privilege escalation risk. The attack vector is network-based with low complexity, requiring only low-privilege authentication (PR:L), making it easily exploitable by any subscriber account. The impact is limited to integrity and availability (image deletion, option modification) without confidentiality breach from the normal user perspective, though log file access (get_smush_logs) could expose sensitive information. The real-world risk is elevated because: (1) WordPress plugins with subscriber-accessible functions represent a broad attack surface in typical multi-user WordPress installations, (2) the missing nonce and whitelist checks indicate a systematic authorization bypass rather than an isolated flaw, and (3) bulk image operations and backup deletion represent tangible business impact. However, this is not a critical severity issue because exploitation requires prior authentication and does not grant arbitrary code execution or database access beyond the Smush-specific operations. The lack of KEV status and POC availability suggests this is a recently disclosed vulnerability without confirmed active exploitation campaigns at time of analysis.

An authenticated subscriber on a WordPress site with WP-Optimize plugin active could trigger the vulnerable Heartbeat handler by opening the WordPress dashboard or front-end pages that load the Heartbeat script. Without requiring any additional user interaction or elevated privileges, the attacker sends a heartbeat request containing a call to admin-restricted Smush methods such as process_bulk_smush to initiate resource-intensive image processing or clean_all_backup_images to delete all backup image files created by the plugin. The Heartbeat handler processes these requests directly without nonce validation or capability checks, allowing the unauthorized operation to succeed. This could be weaponized to disrupt site operations, delete user-generated content backups, or extract sensitive information from log files-all from a subscriber account that should have no administrative privileges.