CVE-2026-5821 is a vulnerability in the Image Optimizer – Optimize Images and Convert to WebP or AVIF WordPress plugin by elemntor. The issue arises from the Image_Backup::remove() function, which uses backup file paths stored in the image_optimizer_metadata post meta field without verifying that these paths reside within the uploads directory. An authenticated attacker with Author-level privileges can inject arbitrary absolute file paths into this metadata via WordPress's Custom Fields interface on their own attachments. When the attacker deletes the attachment, the plugin calls File_System::delete() on each path without validation, enabling deletion of arbitrary files within the web server's filesystem permissions. This can cause denial of service, data loss, or security degradation. The CVSS v3.1 score is 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. No patch or official remediation is currently documented.

An attacker with Author-level access can delete arbitrary files on the server within the web server's filesystem permissions by exploiting insufficient path validation in the plugin's backup deletion process. This can result in denial of service, loss of critical data, or degradation of system security. The vulnerability does not directly impact confidentiality but has high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user capabilities if possible and monitor for suspicious activity related to attachment deletion. Avoid using the vulnerable plugin version or disable it if feasible.