ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2712

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the function in in all versions up to, a…

Published Apr 10, 2026 · updated Jun 17, 2026

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the function in in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler ( ) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files ( ), deleting all backup images ( ), triggering bulk image processing ( ), and modifying Smush options ( ).

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2026 · NIST NVD

    Detected

    The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the function in in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler ( ) enforces. This makes it possibl

  2. Jun 17, 2026 · NIST NVD

    Updated

    The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the function in in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler ( ) enforces. This makes it possibl

Sources

  • CVE.orgVulnerability recordCVE-2026-2712

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-2712

    The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the function in in all versions up to, and including, 4.5.0. This is due to the Heartbea

    nvd.nist.gov

References