WordPress WP-Optimize Plugin < 4.2.0 is vulnerable to SQL Injection<\/p>
Software: WP-Optimize<\/p>
Fixed in version 4.2.0 <\/p>
Affected Version < 4.2.0<\/p>
CVE: CVE-2025-3951<\/p>","date":"2025-06-02"},{"id":"63999124ec2b879a87d3fc82ead42e1dada2c953","name":"WP-Optimize <= 4.1.1 - Authenticated (Admin+) SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-optimize\/wp-optimize-411-authenticated-admin-sql-injection","description":"The WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2025-05-12"},{"id":"EUVD-2025-16607","name":"EUVD-2025-16607","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-16607","description":"The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.","date":"2025-06-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"n","a":"n","score":"4.1","severity":"m","exploitable":"2.3","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:N\/A:N","score":"4.1","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"low","i":"none","a":"none","exploitable":"2.3","impact":"1.4"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"a70a78ed366fc902ba7de8ea9bbdf836e7ca01dc838c23c8639bb38494a28c3e","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance [wp-optimize] < 4.5.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-2712","name":"WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-2712","description":"The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes\/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).","date":"0000-00-00"},{"id":"3e0a79d93ee9f5db4050a11aa41c855f9bda3cdf","name":"WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-optimize\/wp-optimize-450-missing-authorization-to-authenticated-subscriber-plugin-settings-update-and-image-manipulation","description":"The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes\/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).","date":"2026-04-09"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"8049aea0cf23c8572ce04a057fca324cc3d05c4162173ffb61261677bf2878e3","name":"WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance [wp-optimize] < 4.5.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.5.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-7252","name":"CVE-2026-7252","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-7252","description":"[en] The WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key \u2014 it does not begin with an underscore \u2014 allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","date":"2026-05-07"},{"id":"2cf8fa6ac12b5bf43aaee64bec0ede7d8f1c449f","name":"WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-optimize\/wp-optimize-452-authenticated-author-arbitrary-file-deletion-via-original-file-post-meta","description":"The WP-Optimize \u2013 Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key \u2014 it does not begin with an underscore \u2014 allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.","date":"2026-05-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:H","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"h","a":"h","score":"8.1","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:H","score":"8.1","severity":"high","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1778130422"}