WP-Optimize <= 4.5.0 — Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 4.5.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Dmitrii Ignatyev.

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Apr 9, 2026

   CVE published

   Severity medium, CVSS 5.4

2. Nov 13, 2026

   Record last updated