CVE-2026-2712: WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat() function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking UpdraftSmushManagerCommands methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (updraftsmushajax) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (getsmushlogs), deleting all backup images (cleanallbackupimages), triggering bulk image processing (processbulksmush), and modifying Smush options (updatesmushoptions).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2712?
CVE-2026-2712 is considered a high severity vulnerability due to the potential for unauthorized access to plugin settings.
How do I fix CVE-2026-2712?
To fix CVE-2026-2712, update the WP-Optimize plugin to version 4.5.1 or later, which includes the necessary security patches.
Who is affected by CVE-2026-2712?
Users of WP-Optimize plugin versions 4.5.0 and below are affected by CVE-2026-2712.
What type of vulnerability is CVE-2026-2712?
CVE-2026-2712 is categorized as a missing authorization vulnerability that affects functionality in the WP-Optimize plugin.
Can CVE-2026-2712 lead to data breaches?
Yes, CVE-2026-2712 can potentially lead to unauthorized changes to site settings and data breaches if exploited.