Threats Tagged 'cve-2026-7252'

A path traversal vulnerability (CWE-22) exists in the WP-Optimize WordPress plugin up to version 4.5.2, allowing authenticated users with author-level access or higher to delete arbitrary files on the server. This occurs due to insufficient validation of the 'original-file' meta key in the unscheduled_original_file_deletion function. Because the meta key is public and modifiable by authors, attackers can exploit this to delete critical files such as wp-config.php, potentially leading to remote code execution. The vulnerability has a high severity with a CVSS score of 8.1. No official patch or remediation guidance is currently available from the vendor. No known exploits are reported in the wild at this time.