CVE-2026-42756: QuickWebP Path Traversal Vulnerability

CVE-2026-42756 Overview

CVE-2026-42756 is a path traversal vulnerability in the Ludwig You QuickWebP WordPress plugin, marketed as QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly. The flaw allows authenticated attackers to manipulate file path inputs to access or delete files outside the intended directory. According to the PatchStack advisory, the vulnerability enables arbitrary file deletion on affected WordPress sites. All plugin versions up to and including 3.2.7 are affected. The weakness is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers with low privileges can delete arbitrary files on the WordPress server, including wp-config.php, leading to site takeover.

Affected Products

QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly WordPress plugin
All versions from initial release through 3.2.7
WordPress installations with the plugin enabled

Discovery Timeline

2026-05-27 - CVE-2026-42756 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-42756

Vulnerability Analysis

The QuickWebP plugin processes file path parameters without properly sanitizing directory traversal sequences. An attacker submits crafted input containing sequences such as ../ to escape the plugin's intended working directory. The application then operates on the resolved path, enabling deletion of files anywhere the web server process can write.

The attack requires only low-privilege authentication, which on many WordPress sites includes subscriber or contributor accounts. The scope change indicates that the impact extends beyond the vulnerable component to the broader WordPress installation and host filesystem.

Root Cause

The root cause is missing canonicalization and validation of user-supplied file path parameters in the plugin's image management functions. The code accepts a filename or path argument and passes it to a file deletion routine without enforcing that the resolved path remains within an allowed base directory. This pattern matches CWE-22 path traversal weaknesses.

Attack Vector

An authenticated user sends an HTTP request to the vulnerable plugin endpoint with a path parameter containing traversal sequences. Because the plugin runs in the WordPress context, the deletion executes with the privileges of the web server user. Removing wp-config.php forces WordPress into installation mode, which an attacker can leverage to connect the site to an attacker-controlled database and achieve remote code execution. Refer to the PatchStack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-42756

Indicators of Compromise

HTTP POST or GET requests to QuickWebP plugin endpoints containing ../ or URL-encoded %2e%2e%2f sequences in file path parameters
Unexpected deletion of wp-config.php, .htaccess, or core WordPress files
WordPress installation prompt appearing on a previously functional site
Web server error logs showing file not found errors for core WordPress files following plugin activity

Detection Strategies

Inspect web access logs for requests targeting /wp-admin/admin-ajax.php or QuickWebP plugin paths with directory traversal patterns
Monitor filesystem audit logs for file deletion events initiated by the PHP-FPM or web server process outside the plugin's working directory
Apply web application firewall rules that block traversal sequences in plugin parameters

Monitoring Recommendations

Enable WordPress activity logging plugins to capture authenticated user actions targeting media and plugin endpoints
Forward web server logs and filesystem audit events to a centralized analytics platform for correlation
Alert on integrity changes to critical WordPress files such as wp-config.php, index.php, and .htaccess

How to Mitigate CVE-2026-42756

Immediate Actions Required

Disable or remove the QuickWebP plugin until a patched release is installed
Audit WordPress user accounts and revoke unnecessary low-privilege access
Verify integrity of wp-config.php and core WordPress files and restore from backup if tampering is detected
Rotate database credentials and WordPress secret keys if compromise is suspected

Patch Information

At the time of publication, the vendor had not released a fixed version beyond 3.2.7. Monitor the PatchStack Vulnerability Report and the official plugin repository for an updated release that addresses CVE-2026-42756.

Workarounds

Deactivate the QuickWebP plugin from the WordPress admin console
Restrict file system permissions so the web server user cannot delete files outside the uploads directory
Deploy a web application firewall rule that blocks ../ and encoded traversal sequences in plugin request parameters
Limit plugin endpoint access by IP address using .htaccess or reverse proxy rules

bash

# Disable the QuickWebP plugin via WP-CLI
wp plugin deactivate quickwebp
wp plugin delete quickwebp

# Restrict write permissions on critical files
chmod 440 wp-config.php
chown root:www-data wp-config.php