WordPress WP-Optimize Plugin Arbitrary File Deletion Flaw

The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP-Optimize plugin for WordPress contains a path traversal vulnerability (CWE-22) in its file deletion function that allows authenticated users with author-level permissions to delete arbitrary files from the server. Affecting all versions up to 4.5.2, this vulnerability is particularly dangerous because file deletion can serve as a precursor to remote code execution—attackers can remove security files, backups, or other critical system components. While requiring authenticated access limits the immediate blast radius, the ease of obtaining author-level WordPress accounts through social engineering or credential compromise makes this a practical threat for websites using this popular performance optimization plugin.

Casky's 331 mapped security skills leverage Claude's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would identify suspicious activity patterns such as: unusual file system operations from WordPress plugin directories, unexpected DELETE operations on system files outside normal application scope, and authentication logs showing author-level accounts performing file operations inconsistent with their typical behavior. The platform's Claude-powered analysis would correlate these indicators—particularly file path manipulation attempts and post-authentication lateral movement through the file system—allowing security teams to detect exploitation attempts before arbitrary files are removed and potential code execution is achieved.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7252.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-7252

Casky has 331 skills that investigate the attack patterns behind CVE-2026-7252. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn