An arbitrary file deletion vulnerability in the WP-Optimize plugin for WordPress allows authenticated attackers with author-level access or higher to delete server files, potentially leading to remote code execution.

This vulnerability is classified as an improper limitation of a pathname to a restricted directory, or path traversal, within the unscheduled_original_file_deletion function and requires author-level authentication.

A successful exploit allows authenticated attackers to delete arbitrary files on the underlying server, which can lead to severe system compromise, data loss, or remote code execution if critical files such as wp-config.php are removed. This high severity risk is underscored by a CVSS score of 8.1, reflecting the potential for significant integrity and availability impacts to the affected WordPress environment.

Immediate Action: Update the WP-Optimize plugin to the latest version once available or temporarily deactivate the plugin if no patch is immediately accessible.

Proactive Monitoring: Monitor file access logs and server activity for unexpected modifications or deletions of critical system and configuration files.

Compensating Controls: Implement strict file permission controls on the server and restrict user roles to prevent unauthorized author-level access where possible.

Public Exploit Available: false

This high severity vulnerability poses a significant risk to environment integrity through potential remote code execution via file deletion. Administrators should immediately review user access controls, limit author-level privileges, and apply vendor updates as soon as they are released to safeguard the system.