Junglewise Threat Intelligence

CVE-2026-5821: Elemntor Image Optimizer arbitrary file deletion in Image_Backup::remove

CVE-2026-5821 · Severity: high · CVSS 8.1 · Published 2026-07-02

Vendors: Elementor.

Executive brief

The Image Optimizer plugin for WordPress, used to compress images and improve website speed, contains a security flaw that allows certain users to delete critical files from the web server. An attacker with Author-level access or higher can manipulate image metadata to target specific files for deletion when they remove an image attachment. This could lead to a complete website shutdown, loss of important data, or the removal of security configurations.

Technical details

This vulnerability is classified as an arbitrary file deletion (CWE-73) resulting from insufficient path validation in the Image_Backup::remove() function. The plugin fails to verify that backup file paths stored in the 'image_optimizer_metadata' post meta field are restricted to the intended uploads directory. An authenticated attacker with Author-level permissions can use the WordPress Custom Fields interface to modify this metadata on their own attachments, injecting arbitrary absolute file paths. When the attacker deletes the attachment, the 'delete_attachment' hook triggers File_System::delete() on the attacker-supplied paths. This allows for the deletion of any file the web server has permissions to access, potentially causing a Denial of Service (DoS) or bypassing security controls by removing configuration files.

Affected products

  • elemntor Image Optimizer – Optimize Images and Convert to WebP or AVIF up to and including 1.7.4

Timeline

  • 2026-07-02: advisory: NVD publication date
  • 2026-07-02: disclosed: Wordfence disclosure date

References