CVE-2026-5821: WordPress Image Optimizer Path Traversal Flaw

CVE-2026-5821 Overview

The Image Optimizer plugin for WordPress contains an arbitrary file deletion vulnerability in versions up to and including 1.7.4. The flaw resides in the Image_Backup::remove() function, which uses backup file paths stored in post meta without validating that they reside within the uploads directory. Authenticated attackers with Author-level access can inject arbitrary absolute paths into the image_optimizer_metadata post meta via WordPress's Custom Fields interface. When the attachment is deleted, the plugin calls File_System::delete() on each attacker-controlled path. This weakness is classified as [CWE-73] External Control of File Name or Path.

Critical Impact
Authenticated attackers with Author-level access can delete arbitrary files on the server, potentially causing denial of service, data loss, or wider security degradation.

Affected Products

WordPress Image Optimizer plugin versions up to and including 1.7.4
Sites running the plugin with Author-level or higher user accounts
WordPress installations where the plugin processes the delete_attachment hook

Discovery Timeline

2026-07-02 - CVE-2026-5821 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-5821

Vulnerability Analysis

The Image Optimizer plugin stores backup file paths inside the image_optimizer_metadata post meta field. When an attachment is deleted, the plugin iterates the backups array and passes each entry directly to File_System::delete(). No check confirms that the path falls within the WordPress uploads directory or that it points to a plugin-generated backup file.

Authors in WordPress can edit post meta on attachments they own through the Custom Fields interface. This gives an attacker a supported channel to overwrite the backups array with absolute paths such as /var/www/html/wp-config.php or arbitrary files on the server. Deleting the attachment then triggers the vulnerable removal routine.

The impact depends on file system permissions granted to the web server user. Removing wp-config.php forces WordPress into the setup flow, which an attacker can leverage to reconfigure the site against an attacker-controlled database, escalating this file deletion into full site takeover.

Root Cause

The root cause is insufficient path validation in Image_Backup::remove() (see classes/image/image-backup.php line 117). The function trusts data retrieved from image_optimizer_metadata post meta, which is writable by low-privileged authenticated users. There is no allow-list check restricting deletions to the uploads directory and no verification that the path corresponds to a plugin-created backup.

Attack Vector

The attack requires network access and Author-level (or higher) authentication. The attacker uploads an attachment, edits its custom fields to inject absolute file paths into the image_optimizer_metadata backups array, and then deletes the attachment. The delete_attachment hook triggers the vulnerable removal code, which deletes every path in the array without validation.

The vulnerability mechanism is documented in the Wordfence Vulnerability Report and in the WordPress Backup Handling Code.

Detection Methods for CVE-2026-5821

Indicators of Compromise

Unexpected deletion of WordPress core files such as wp-config.php, .htaccess, or plugin/theme files coinciding with attachment deletion events.
image_optimizer_metadata post meta records containing absolute file paths outside the site's uploads directory.
Author-level accounts modifying custom fields on attachment posts prior to deleting those attachments.

Detection Strategies

Audit wp_postmeta rows where meta_key = 'image_optimizer_metadata' for paths that do not begin with the site's uploads directory prefix.
Monitor PHP file system calls originating from the Image Optimizer plugin for unlink() operations targeting paths outside wp-content/uploads/.
Correlate WordPress delete_attachment hook activity with file system change events for sensitive paths.

Monitoring Recommendations

Enable WordPress audit logging for post meta modifications performed by Author-level and above accounts.
Alert on any modification or deletion of wp-config.php, .htaccess, and files under wp-includes/ or wp-admin/.
Track new Author registrations and privilege changes on sites running the Image Optimizer plugin.

How to Mitigate CVE-2026-5821

Immediate Actions Required

Update the Image Optimizer plugin to a version above 1.7.4 as soon as a fixed release is available.
Review all Author-level and higher accounts and remove any that are unnecessary or unrecognized.
Restrict registration and role assignment on public-facing WordPress sites to reduce the attacker pool.

Patch Information

A plugin change set is referenced in the WordPress Plugin Change Set. Site administrators should upgrade to the fixed release published after version 1.7.4 and verify the plugin version in the WordPress admin dashboard.

Workarounds

Deactivate the Image Optimizer plugin until a patched version is installed.
Restrict the edit_post_meta capability for Author-level accounts by removing custom field editing on attachments through a security plugin or map_meta_cap filter.
Enforce least-privilege file system permissions so the web server user cannot delete WordPress core files or sensitive host files.

bash

# Example: disable custom fields editing for non-admin roles via mu-plugin
# Save as wp-content/mu-plugins/restrict-postmeta.php
add_filter('map_meta_cap', function($caps, $cap, $user_id, $args) {
    if ($cap === 'edit_post_meta' && !user_can($user_id, 'manage_options')) {
        $caps[] = 'do_not_allow';
    }
    return $caps;
}, 10, 4);