CVE-2026-2712 PUBLISHED

WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation

Assigner: Wordfence
Reserved: 18.02.2026 Published: 10.04.2026 Updated: 10.04.2026

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receive_heartbeat() function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking Updraft_Smush_Manager_Commands methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (updraft_smush_ajax) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (get_smush_logs), deleting all backup images (clean_all_backup_images), triggering bulk image processing (process_bulk_smush), and modifying Smush options (update_smush_options).

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Product Status

Vendor davidanderson
Product WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance
Versions Default: unaffected
  • affected from 0 to 4.5.0 (incl.)

Credits

  • Dmitrii Ignatyev finder

References

Problem Types

  • CWE-863 Incorrect Authorization CWE