The WP-Optimize plugin for WordPress suffers from a path traversal vulnerability in the unscheduled_original_file_deletion function, which improperly limits file pathnames to restricted directories. Authenticated users with author-level privileges can manipulate the 'original-file' meta key on attachment posts to delete arbitrary files on the server. This vulnerability affects all versions up to and including 4.5.2. Because the 'original-file' meta key is not protected (does not start with an underscore), authors can modify it via the Edit Media form or REST API, enabling the attack. Deleting critical files such as wp-config.php can facilitate remote code execution. The CVSS 3.1 base score is 8.1, indicating high severity. No vendor patch or official remediation is currently documented.

Authenticated attackers with author-level access can delete arbitrary files on the server hosting the WordPress site. This can lead to denial of service or remote code execution if key files like wp-config.php are deleted. The vulnerability does not allow unauthenticated access but leverages insufficient file path validation and publicly writable meta keys to escalate impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user permissions where possible and monitor for suspicious file deletion activity. Avoid granting author-level access to untrusted users. Consider disabling or limiting the use of the WP-Optimize plugin if feasible until a patch is released.