CVE-2026-5821

A WordPress plugin called Image Optimizer contains a vulnerability that allows an authenticated attacker with Author-level access or higher to delete any file on the server. This is due to the plugin's failure to properly verify the paths of backup files before deleting them, allowing an attacker to inject arbitrary file paths into the plugin's metadata. When the attacker deletes an attachment, the plugin will attempt to delete the specified files without checking if they are within the allowed directory, enabling the attacker to delete files outside of the uploads directory.

Based on public CVE data (MITRE/NVD).