The Image Optimizer plugin for WordPress versions up to and including 1.7.4 contains a vulnerability that allows authenticated users with Author-level access to delete arbitrary files on the server. This occurs because the plugin does not properly validate file paths before deletion, trusting user-controlled metadata. Exploitation can lead to denial of service, data loss, or security degradation.