CVE-2026-7252General

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 3 classified signals
Peaked 1d ago at 2 mentions (2026-05-07); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

General

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-07	2	General2
2026-05-29	1	General1

Full discourse3 posts

ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker132d
General
【脆弱性情報】 CVE-2026-7252 WP-Optimizeの脆弱性について https://www.cybernote.click/2026/05/22/%e3%80%90%e8%84%86%e5%bc%b1%e6%80%a7%e6%83%85%e5%a0%b1%e3%80%91-cve-2026-7252-wp-optimize%e3%81%ae%e8%84%86%e5%bc%b1%e6%80%a7%e3%81%ab%e3%81%a4%e3%81%84%e3%81%a6/ #IT #Security #cybersecurity
Post summary
The post merely announces CVE‑2026‑7252 for WP‑Optimize and provides a link, but offers no further details on exploitation, patches, or technical specifics.
0000040
208 followersView on X
CVE@CVEnew154d
General
CVE-2026-7252 The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to… https://www.cve.org/CVERecord?id=CVE-2026-7252
Post summary
An announcement of CVE-2026-7252 indicates WP-Optimize plugin is vulnerable to arbitrary file deletion, with no further details on exploitation or mitigation supplied.
00000102
57.4K followersView on X
Kaitan ID Security@KaitanSecurity154d
General
⚠️ HIGH — CVE-2026-7252 The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPres… CVSS 8.1 Full analysis → https://sec.kaitan.id/cves/CVE-2026-7252 #WordPress #CyberSecurity #InfoSec
Post summary
The post announces CVE‑2026‑7252 with a CVSS score of 8.1 and links to an analysis page, but provides no proof‑of‑concept, exploit code, active exploitation evidence, patch, or detailed technical specifics.
0000045
518 followersView on X

Explore more

Back to dashboard