CVE-2026-5821: Image Optimizer WordPress Plugin Arbitrary File Deletion Vulnerability

Technical summary

CVE-2026-5821 is a path traversal and arbitrary file deletion vulnerability in Image Optimizer for WordPress. The Image_Backup::remove() function processes file paths stored in the image_optimizer_metadata post meta field without validation. The vulnerability exists because: (1) backup file paths are stored in post meta that authenticated users can modify via WordPress's Custom Fields interface, (2) the delete_attachment hook triggers file deletion operations on these paths, and (3) File_System::delete() is called on unsanitized paths without verifying they are constrained to the wp-content/uploads directory. An attacker with Author role or higher can inject absolute file paths into the backups array and subsequently trigger deletion by removing the attachment, resulting in arbitrary file deletion within the web server's filesystem permissions (typically the www-data user on Linux systems). The attack requires no cross-site request forgery token bypass and no privilege escalation beyond Author level.

Business impact

This vulnerability enables data destruction and operational disruption. An author could systematically delete critical files: WordPress configuration files (wp-config.php), theme and plugin code, logs, database backups, or sensitive documents stored within the web root. The impact scales with server configuration—if the web server runs with elevated privileges or shares a host with other applications, collateral damage is possible. Additionally, the ability to delete logs can aid in covering tracks after other attacks, reducing forensic visibility and compliance evidence preservation.

Affected systems

Image Optimizer for WordPress, versions 1.7.4 and earlier, is vulnerable. Any WordPress installation with this plugin activated and users holding Author role or higher (including Administrators) can exploit the flaw. Self-hosted WordPress sites are at direct risk; managed WordPress hosting may provide some mitigations depending on server hardening and permission restrictions. Verify your installation version via Plugins > Installed Plugins in the WordPress admin dashboard.

Exploitability

Exploitation is straightforward and requires no special tools. An authenticated author logs into WordPress, navigates to an image attachment, accesses the Custom Fields meta box (if visible—it may require enabling via Screen Options), edits the image_optimizer_metadata field to inject a path like /var/www/html/wp-config.php, saves, and deletes the attachment. The file is removed immediately. No public exploit code is necessary; the WordPress interface itself is the attack vector. The CVSS score of 8.1 (HIGH) reflects the combination of low attack complexity, low privilege requirement, and high impact to integrity and availability.

Remediation

Update Image Optimizer to a patched version released after 1.7.4 that implements proper path validation in the Image_Backup::remove() function. Verify against the vendor's official advisory and changelog. If an immediate patch is unavailable, mitigate by: (1) restricting Author role assignment to trusted users only, (2) disabling the Custom Fields meta box for non-administrators via role management or plugins, (3) using a Web Application Firewall rule to block POST requests to admin-ajax.php that modify image_optimizer_metadata, or (4) temporarily deactivating the plugin if not actively used.

Patch guidance

Check the Image Optimizer plugin repository or the vendor's website for version 1.7.5 or later, which should contain fixes for path validation. Apply updates immediately once available. For WordPress administrators managing multiple sites, prioritize environments where untrusted authors have upload permissions. Test patches in a staging environment first to ensure no regressions with existing backup functionality.

Detection guidance

Monitor WordPress logs and server file access logs for unusual deletion activity. Look for: (1) attachment deletion events in wp_posts where image_optimizer_metadata contains absolute paths (e.g., /etc/, /var/www outside uploads/), (2) repeated delete_attachment hook executions in short time windows, (3) file deletion logs for sensitive files like wp-config.php or .htaccess. If your WordPress installation has Custom Fields logging or audit plugins, examine metadata edit history for image_optimizer_metadata changes. Use File Integrity Monitoring (FIM) tools to alert on unexpected deletion of configuration or core files.

Why prioritize this

Prioritize patching this vulnerability because it affects core WordPress file integrity and enables denial of service or data destruction by a low-privileged but legitimate user. Unlike remote unauthenticated exploits, this requires internal access, which lowers urgency compared to zero-days but remains critical given that Author roles are often assigned to content creators and third-party contributors. The HIGH CVSS score and the ease of exploitation justify immediate action on systems with untrusted authors.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: Network-based attack vector (AV:N), Low attack complexity (AC:L), Low privilege requirement (PR:L—Author role), No user interaction needed (UI:N), Unchanged scope (S:U), No confidentiality impact (C:N), High integrity impact (I:H—arbitrary files deleted), and High availability impact (A:H—denial of service possible). The score is not critical (9.0+) because it requires authentication and is scoped to filesystem permissions of the web server process, not system-wide. However, the combination of ease of exploitation, lack of complexity, and severe destructive potential justifies HIGH severity and immediate remediation.

Frequently asked questions