Vulnerabilities and security researches forimage-optimization image-optimization

Feb 27, 2026

CVE, Research URL: CVE-2026-25387
Home page URL: Security reports for Image Optimizer by Elementor – Compress, Resize and Optimize Images
Application: Image Optimizer by Elementor – Compress, Resize and Optimize Images
Date: Feb 19, 2026
Research Description: Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through <= 1.7.1.
Affected versions: max 1.7.2.
Status: vulnerable

Jun 25, 2026

PSC, Research URL: PSC-2026-64666
Home page URL: Security reports for Image Optimizer by Elementor – Compress, Resize and Optimize Images
Application: Image Optimizer by Elementor – Compress, Resize and Optimize Images
Date: Jun 25, 2026
Research Description: Image optimization plugins work directly with uploaded media, generated derivatives, file names, MIME types, and background processing jobs. That makes them useful for performance, but also security-sensitive because unsafe media handling can lead to path manipulation, unauthorized file access, broken public assets, or exposure of media metadata. Image Optimizer - Optimize Images and Convert to WebP or AVIF version 1.7.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64666, confirming that the plugin was reviewed from a secure code perspective with attention to common exploitation paths for image optimization, format conversion, media processing, and upload pipeline behavior.
Affected versions: Min 1.7.6, max 1.7.6.
Status: SAFE & CERTIFIED

Jul 02, 2026

CVE, Research URL: CVE-2026-5821
Home page URL: Security reports for Image Optimizer by Elementor – Compress, Resize and Optimize Images
Application: Image Optimizer by Elementor – Compress, Resize and Optimize Images
Date: Jul 02, 2026
Research Description: The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on their own attachments via WordPress's Custom Fields interface, injecting arbitrary absolute file paths into the backups array. When the attacker subsequently deletes the attachment, the plugin calls File_System::delete() on each path without validation. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server within the web server's filesystem permissions, potentially leading to denial of service, data loss, or security degradation.
Affected versions: max 1.7.5.
Status: vulnerable