CVE-2026-124969
Deferred Deferred - Pending Action

Arbitrary File Deletion in Optimole WordPress Plugin

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: Wordfence

Description
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires PEAR's Archive_Tar library to be present and loadable on the host (common in official WordPress Docker images and many PHP distributions), and an administrator must subsequently use the plugin's Rename control on any attachment after the attacker has staged a malicious payload in a comment. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-14
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-124969
EUVD
EUVD-2026-125850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization From 0 (inc) to 4.2.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Optimole WordPress plugin has a flaw in its file handling that allows unauthenticated attackers to delete arbitrary files on the server. This happens due to weak validation in the replace_urls_in_value function. If an administrator later uses the plugin's Rename feature on an attachment, it could trigger remote code execution if critical files like wp-config.php are deleted. Exploitation requires the PEAR Archive_Tar library to be present.

Detection Guidance

Check for unauthorized file deletions or suspicious activity in server logs. Look for attempts to access the replace_urls_in_value function or PEAR's Archive_Tar library usage. Monitor for unexpected changes in WordPress attachments or comments.

Impact Analysis

This vulnerability can lead to complete server compromise. Attackers could delete critical files, causing website downtime or data loss. If wp-config.php is deleted, attackers might gain full control over the WordPress site. Even without direct access, the risk of remote code execution remains high if the right files are removed.

Mitigation Strategies

Update the Optimole plugin to the latest version beyond 4.2.19. Remove PEAR's Archive_Tar library if not required. Review server logs for signs of exploitation. Restrict file deletion permissions for the plugin.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...