{"id":"CVE-2026-7252","aliases":["EUVD-2026-28323","GHSA-p78j-pm32-q3pf"],"status":"published","title":"WP-Optimize \u003c= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta","description":"The WP-Optimize – Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0095,"percentile":0.61475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-05-07T04:27:10Z","modified":"2026-06-17T11:02:05Z","products":[{"vendor":"davidanderson","product":"wp-optimize – cache, compress images, minify \u0026 clean database to boost page speed \u0026 performance"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc815ef2-dd02-4faa-b202-dd1552f889db?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L1649"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L1649"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L1645"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L1645"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-updraft-smush-manager.php#L81"},{"url":"https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.5.2/includes/class-updraft-smush-manager.php#L81"},{"url":"https://plugins.trac.wordpress.org/changeset/3518513/wp-optimize/trunk/includes/class-updraft-smush-manager.php"},{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-optimize/tags/4.5.2\u0026new_path=%2Fwp-optimize/tags/4.5.3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7252"},{"url":"https://github.com/advisories/GHSA-p78j-pm32-q3pf"}],"sources":{"cve":[{"id":"CVE-2026-7252","title":"WP-Optimize \u003c= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta","description":"The WP-Optimize – Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","status":"published","published":"2026-05-07T04:27:10.902Z","modified":"2026-05-07T14:15:26.842Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-28323","description":"The WP-Optimize – Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","status":"published","published":"2026-05-07T04:27:10Z","modified":"2026-05-07T14:15:26Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:15.366699Z"}],"ghsa":[{"id":"GHSA-p78j-pm32-q3pf","title":"The WP-Optimize – Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026...","description":"The WP-Optimize – Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","status":"published","published":"2026-05-07T06:31:43Z","modified":"2026-05-07T06:31:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:07:56.440319Z"}],"nvd":[{"id":"CVE-2026-7252","description":"The WP-Optimize – Cache, Compress images, Minify \u0026 Clean database to boost page speed \u0026 performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","status":"published","published":"2026-05-07T06:16:05.567Z","modified":"2026-06-17T11:02:05.307Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:17.842772Z"}]}}