VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site
WordPress plugin

Optimole <= 4.2.19 — Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename

CVE-2026-124969Published · Updated

Action summary

Affected: ≤4.2.19Update to 4.2.20 or newer

All remediation steps

200K+ active installs

Watch plugin
Severity
High7.1
CVSS
7.1
CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
What does this vector mean?
AV:N Attack vector
Network
AC:L Attack complexity
Low
PR:N Privileges required
None
UI:R User interaction
Required
S:U Scope
Unchanged
C:N Confidentiality
None
I:L Integrity
Low
A:H Availability
High
Weakness
CWE-502 PHP Object Injection
Required access
No account needed
Exploit prediction (EPSS)
No score
CISA KEV
Not listed
On this page9

Am I affected?

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp

  1. Affected≤ 4.2.19
  2. Patched in4.2.20
  3. Latest4.2.20

Update to 4.2.20 or newer.

You are affected if you run ≤ 4.2.19. Version 4.2.20 and later are not affected by this issue.

  • Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization.
  • No admin access? Run a passive check of your site. It reads public files only.
  • No account is needed to exploit this. Treat any exposed site on an affected version as at risk.
  • You are affected if you run the Optimole plugin at version 4.2.19 or earlier.
  • You are affected if untrusted users can post comments on your site, since comment fields are used to stage the payload.
  • You are affected if an administrator account can be induced to use the plugin's Rename control on an attachment.
  • You may be at greater risk if PEAR's Archive_Tar library is present and loadable on your host.

What to do

  1. Upgrade the Optimole plugin to version 4.2.20 or later.
  2. Restrict or moderate comment submissions where practical, since comment fields are the staging point for the payload.
  3. Avoid using the plugin's Rename control on attachments until the update is applied.
  4. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
  5. Watch Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to daroo.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires PEAR's Archive_Tar library to be present and loadable on the host (common in official WordPress Docker images and many PHP distributions), and an administrator must subsequently use the plugin's Rename control on any attachment after the attacker has staged a malicious payload in a comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Analysis

AI-assisted, based on the vendor patch · river/deepseek-ai/DeepSeek-V4.1-Flash

This analysis is written from the vendor patch and public data. It has not been reproduced in the VulnCrest lab.

Optimole versions up to and including 4.2.19 deserialize untrusted data stored in the database without restricting which classes may be created, giving an attacker a path to PHP object injection and arbitrary file deletion. An unauthenticated attacker can stage the payload in comment fields, but an administrator must later trigger the vulnerable code by using the plugin's Rename control on an attachment. The issue is rated 7.1 (high) and is fixed in version 4.2.20.

Reviewed by auto (§8.3a). Updated .

Root cause

The plugin does not properly validate file paths and deserializes untrusted serialized data found in the database. The vulnerable logic sits in the replace_urls_in_value function of inc/media_rename/attachment_db_renamer.php, where @unserialize() is called without restricting allowed classes.

The fix

Version 4.2.20 added a new UploadsPath class that verifies a path resolves inside the uploads directory before file operations are performed on attachment metadata paths. Unserialization now passes allowed_classes limited to stdClass, and values containing references, unreadable content, or objects other than stdClass are left as stored. The patch also adds checks that nested serialized strings can be safely re-serialized (reads_back) plus a depth cap so text replacements do not corrupt declared string lengths, switches database identifier handling from %i placeholders to explicitly quoted identifiers, widens the serialized-data detection regex to ^[aiOCEs]:[0-9], and adds a fallback to a legacy attribute builder for the video player block wrapper on WordPress versions lacking get_block_wrapper_attributes().

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

More in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

All 17
More vulnerabilities in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor
≤4.2.18Update to 4.2.19
CVE-2026-120739
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content
≤4.2.18Update to 4.2.19
CVE-2026-120677
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer
≤4.2.17Update to 4.2.18
CVE-2026-119070
Medium4.34.2.14 - Authenticated (Subscriber+) Information Exposure
4.0.0 – 4.2.14Update to 4.2.15
CVE-2026-96530
Medium4.3Missing Authorization
≤4.2.14Update to 4.2.15
CVE-2026-102375

Same weakness (PHP Object Injection)

All PHP Object Injection
Other PHP Object Injection vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block
Flatsome≤3.20.12Update to 3.20.13
CVE-2026-18742
Critical9.8Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field
AutomatorWP Webhooks≤1.4.4Update to 1.4.5
CVE-2026-126173
High7.2Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header
EZ SQL Reports Shortcode Widget and DB Backup≤5.25.25Update to 5.26.45
CVE-2026-120688
Critical9.8Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
Chatterbug Forms – Fast, Flexible WordPress Form Builder≤1.0.2Update to 1.1
CVE-2026-125055

Timeline

  1. CVE published

    Severity high, CVSS 7.1

  2. Record last updated

  3. VulnCrest analysis published

Sources & licenses

Wordfence record
Vulnerability data
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
CVE® identifiers
Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
CVSS / CWE
National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
VulnCrest content
Analysis, summary, remediation and page layout © VulnCrest. Not sourced from NVD.

How we use these sources

Search VulnCrest Radar

Jump to

Are you sure?