The WP-Optimize – Cache

CVE-2026-7252 is an arbitrary file deletion flaw in the WP-Optimize WordPress plugin caused by weak path validation in unscheduled_original_file_deletion and the use of a public attachment meta key, original-file. Affected versions are all releases up to and including 4.5.2; the vendor fix landed in 4.5.3. An attacker who already has Author-level access or higher can point that meta key at a server file and trigger deletion, including high-value targets like wp-config.php.

The vendor's 8.1/HIGH score is technically defensible, but operationally it overstates the population at risk. This is not unauthenticated internet RCE; it is a post-initial-access WordPress role abuse issue that needs a valid session plus a role many public sites never grant to strangers. The impact can absolutely be ugly, but the entry condition is the whole story here, so this gets downgraded to MEDIUM for enterprise patch scheduling.

Why this verdict

• Requires Author credentials: PR:L is not a paperwork detail here; it means the attacker already beat your identity layer or another WordPress bug first.
• RCE is conditional, not native: the vulnerability is arbitrary file deletion, and the takeover story depends on deleting the right file and successfully converting that into reinstall-state abuse or equivalent follow-on impact.
• Exposure is broad but not broadly reachable: WP-Optimize has 1M+ installs, but most enterprise sites are not handing anonymous users Author rights, which meaningfully narrows the practical target set.

Why not higher?

This is not an unauthenticated edge-service flaw and not a reliable one-packet RCE. The exploit chain depends on authenticated WordPress role abuse and then a second-stage conversion from file deletion to full compromise, which is enough friction to keep it out of HIGH/CRITICAL in enterprise prioritization.

Why not lower?

Once the attacker has the needed role, exploitation is simple and impact can be severe: deleting wp-config.php can produce immediate outage and sometimes full site takeover. On content-heavy organizations with many contributor/editorial accounts, the prerequisite is not exotic, so this is more than backlog lint.

1. Prune Author accounts — Review every WordPress site using WP-Optimize and remove stale or unnecessary Author+ accounts, especially on public-facing marketing properties and microsites. For a MEDIUM verdict there is no noisgate mitigation SLA, but this is the best temporary risk reduction if patch rollout will stretch.
2. Restrict media and REST access for low-trust roles — If your publishing workflow allows it, limit media upload/edit and attachment REST operations for non-admin roles until all sites are on 4.5.3+. This directly attacks the exploit path by preventing untrusted users from setting the attacker-controlled attachment metadata.
3. Monitor wp-config.php and core files — Add file integrity monitoring or host telemetry for deletion/modification of wp-config.php, .htaccess, and WordPress core files under the webroot. There is no mitigation SLA for MEDIUM, but this gives you a fast tripwire for the exact destructive outcome this bug is known for.
4. Put editorial sites behind SSO and MFA — Where business reality allows it, move WordPress author/editor authentication behind your enterprise IdP and require MFA for all content roles, not just admins. That cuts off the most realistic entry condition for this bug: compromised low-privilege publishing accounts.

Run this on the target WordPress host or against a mounted webroot from an auditor workstation. Invoke it as python3 check_wp_optimize_cve_2026_7252.py /var/www/html or python check_wp_optimize_cve_2026_7252.py C:\inetpub\wwwroot; it only needs read access to the plugin files.

#!/usr/bin/env python3
# check_wp_optimize_cve_2026_7252.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
from pathlib import Path

VULN_MAX = "4.5.2"
PATCHED_MIN = "4.5.3"


def normalize(v):
    parts = re.findall(r"\d+", v or "")
    if not parts:
        return None
    return tuple(int(x) for x in parts)


def cmp_ver(a, b):
    na = normalize(a)
    nb = normalize(b)
    if na is None or nb is None:
        return None
    maxlen = max(len(na), len(nb))
    na = na + (0,) * (maxlen - len(na))
    nb = nb + (0,) * (maxlen - len(nb))
    if na < nb:
        return -1
    if na > nb:
        return 1
    return 0


def extract_version(text):
    patterns = [
        r"(?im)^\s*Stable tag:\s*([0-9][0-9A-Za-z._-]*)\s*$",
        r"(?im)^\s*Version:\s*([0-9][0-9A-Za-z._-]*)\s*$",
        r"(?im)^\s*\*\s*Version\s+([0-9][0-9A-Za-z._-]*)\s*$",
    ]
    for pat in patterns:
        m = re.search(pat, text)
        if m:
            return m.group(1).strip()
    return None


def read_text(path):
    try:
        return Path(path).read_text(encoding="utf-8", errors="ignore")
    except Exception:
        return None


def locate_plugin(root):
    root = Path(root)
    candidates = [
        root / "wp-content" / "plugins" / "wp-optimize",
        root / "wordpress" / "wp-content" / "plugins" / "wp-optimize",
    ]
    for c in candidates:
        if c.is_dir():
            return c
    for p in root.rglob("wp-optimize"):
        if p.is_dir() and p.parent.name == "plugins":
            return p
    return None


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 check_wp_optimize_cve_2026_7252.py <wordpress_root>")
        sys.exit(2)

    root = sys.argv[1]
    plugin_dir = locate_plugin(root)
    if not plugin_dir:
        print("UNKNOWN - WP-Optimize plugin directory not found")
        sys.exit(2)

    files_to_check = [
        plugin_dir / "readme.txt",
        plugin_dir / "wp-optimize.php",
    ]

    version = None
    source_file = None
    for f in files_to_check:
        if f.is_file():
            txt = read_text(f)
            if txt:
                version = extract_version(txt)
                if version:
                    source_file = str(f)
                    break

    if not version:
        print(f"UNKNOWN - unable to determine WP-Optimize version from {plugin_dir}")
        sys.exit(2)

    if cmp_ver(version, VULN_MAX) is not None and cmp_ver(version, VULN_MAX) <= 0:
        print(f"VULNERABLE - WP-Optimize version {version} detected in {source_file} (affected: <= {VULN_MAX})")
        sys.exit(1)

    if cmp_ver(version, PATCHED_MIN) is not None and cmp_ver(version, PATCHED_MIN) >= 0:
        print(f"PATCHED - WP-Optimize version {version} detected in {source_file} (fixed: >= {PATCHED_MIN})")
        sys.exit(0)

    print(f"UNKNOWN - WP-Optimize version {version} detected in {source_file}, but comparison failed")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. Wordfence vulnerability record
2. NVD CVE detail
3. WordPress.org plugin page and changelog
4. Patchstack WP-Optimize vulnerability history
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS data and report documentation