Is CVE-2026-5821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5821 being exploited in the wild.

How severe is CVE-2026-5821?

High severity, with a CVSS score of 8.1, published 2 July 2026.

Which products and versions are affected?

Elementor Image Optimizer – Optimize Images and Convert to WebP or AVIF up to and including 1.7.4.

Is there a fix for CVE-2026-5821?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5821 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5821?

Check whether you run Elementor Image Optimizer – Optimize Images and Convert to WebP or AVIF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5821: Elemntor Image Optimizer arbitrary file deletion in Image_Backup::remove

CVE-2026-5821 · Severity: high · CVSS 8.1 · Published 2026-07-02

The Image Optimizer plugin for WordPress, used to compress images and improve website speed, contains a security flaw that allows certain users to delete critical files from the web server. An attacker with Author-level access or higher can manipulate image metadata to target specific files for deletion when they remove an image attachment. This could lead to a complete website shutdown, loss of important data, or the removal of security configurations.

Vendors: Elementor.

Quick answers

Is CVE-2026-5821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5821 being exploited in the wild.
How severe is CVE-2026-5821?: High severity, with a CVSS score of 8.1, published 2 July 2026.
Which products and versions are affected?: Elementor Image Optimizer – Optimize Images and Convert to WebP or AVIF up to and including 1.7.4.
Is there a fix for CVE-2026-5821?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5821 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5821?: Check whether you run Elementor Image Optimizer – Optimize Images and Convert to WebP or AVIF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an arbitrary file deletion (CWE-73) resulting from insufficient path validation in the Image_Backup::remove() function. The plugin fails to verify that backup file paths stored in the 'image_optimizer_metadata' post meta field are restricted to the intended uploads directory. An authenticated attacker with Author-level permissions can use the WordPress Custom Fields interface to modify this metadata on their own attachments, injecting arbitrary absolute file paths. When the attacker deletes the attachment, the 'delete_attachment' hook triggers File_System::delete() on the attacker-supplied paths. This allows for the deletion of any file the web server has permissions to access, potentially causing a Denial of Service (DoS) or bypassing security controls by removing configuration files.

Affected products

elemntor Image Optimizer – Optimize Images and Convert to WebP or AVIF up to and including 1.7.4

Timeline

2026-07-02: advisory: NVD publication date
2026-07-02: disclosed: Wordfence disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.