CVE-2026-5821 is a vulnerability in the Image Optimizer – Optimize Images and Convert to WebP or AVIF WordPress plugin by elemntor. The issue arises from the Image_Backup::remove() function, which uses backup file paths stored in the image_optimizer_metadata post meta field without validating that these paths reside within the uploads directory. An authenticated attacker with Author-level privileges can inject arbitrary absolute file paths into this metadata via WordPress's Custom Fields interface. Upon deletion of the associated attachment, the plugin calls File_System::delete() on these paths without validation, enabling arbitrary file deletion within the web server's filesystem permissions. This vulnerability is classified as CWE-73 (External Control of File Name or Path) and has a CVSS v3.1 score of 8.1, indicating high severity.

An attacker with Author-level access can delete arbitrary files on the server within the permissions of the web server process. This can cause denial of service by removing critical files, data loss by deleting important data, or security degradation if sensitive files are deleted or system stability is compromised. The vulnerability does not impact confidentiality but has high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to post meta manipulation. Avoid deleting attachments unless necessary and consider disabling the plugin if exploitation risk is unacceptable.