CVE-2026-124969: Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replaceurlsinvalue function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires PEAR's ArchiveTar library to be present and loadable on the host (common in official WordPress Docker images and many PHP distributions), and an administrator must subsequently use the plugin's Rename control on any attachment after the attacker has staged a malicious payload in a comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Affected Software
Event History
Frequently Asked Questions
What conditions must be met for exploitation to succeed?
An unauthenticated attacker must first stage a malicious payload in a comment, and PEAR's Archive_Tar library must be installed and loadable. An administrator must then use the plugin's Rename control on any attachment; the attacker cannot complete exploitation alone.
Are sites using the plugin's normal image-optimization features exposed without further action?
The described exploit path requires use of the plugin's attachment Rename control after a malicious comment has been staged. The provided information does not indicate that image optimization, WebP/AVIF conversion, CDN, or lazy-load operations alone trigger the issue.
What is the impact if the vulnerability is successfully exploited?
An attacker can cause arbitrary file deletion on the server. Deletion of a file such as wp-config.php can readily lead to remote code execution.
Which deployments are more likely to meet the library prerequisite?
Hosts where PEAR's Archive_Tar library is present and loadable are affected by this prerequisite. The library is described as common in official WordPress Docker images and many PHP distributions.