CVE-2026-2712 is an incorrect authorization vulnerability (CWE-863) in the WP-Optimize plugin for WordPress, specifically in the receive_heartbeat() function within includes/class-wp-optimize-heartbeat.php. The Heartbeat handler directly calls Updraft_Smush_Manager_Commands methods without verifying user capabilities, nonce tokens, or command whitelists, unlike the standard AJAX handler. This allows authenticated users with low privileges (Subscriber and above) to invoke administrative Smush operations such as reading logs, deleting backup images, bulk processing images, and updating Smush settings. The vulnerability affects all versions up to and including 4.5.0.

An attacker with authenticated Subscriber-level access or higher can exploit this vulnerability to perform unauthorized administrative actions related to image optimization and backup management. This includes reading sensitive log files, deleting all backup images, initiating bulk image processing, and changing plugin options. While the vulnerability does not allow direct data confidentiality breaches, it can disrupt site functionality and availability related to image handling and backups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unusual activity related to Smush operations. Avoid granting Subscriber or higher access to untrusted users. Follow vendor updates closely for an official patch or temporary workaround.