CVE-2026-5821

Name of the Vulnerable Software and Affected Versions Image Optimizer versions prior to 1.7.5

Description An issue exists where insufficient path validation in the Image Backup::remove() function allows for arbitrary file deletion. The plugin stores backup file paths in the image optimizer metadata post meta field and trusts these paths when executing the delete attachment hook. An authenticated attacker with Author-level access can modify the image optimizer metadata field via the Custom Fields interface to inject absolute file paths. When the attachment is deleted, the plugin invokes File System::delete() on the specified paths without verification, enabling the deletion of any file within the web server's filesystem permissions. This can result in data loss, security degradation, or denial of service.

Recommendations Update to a version newer than 1.7.4. As a temporary mitigation, restrict Author-level users from accessing the Custom Fields interface to prevent modification of the image optimizer metadata field.