The WP‑Optimize plugin contains a missing capability check in the receive_heartbeat() handler. This allows any authenticated user with a role of Subscriber or higher to invoke smush functions that normally require administrator privileges. Through accepted heartbeat requests, an attacker can read smush logs, delete all backup images, trigger bulk image processing, or modify smush options, potentially causing data loss or denial of service for the media library.

WordPress sites running the WP‑Optimize plugin version 4.5.0 or earlier, developed by David Anderson. Any installation with the plugin activated and where a Subscriber role is present is susceptible.

The CVSS score is 5.4, indicating medium severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog. An attacker only needs an authenticated account with Subscriber or higher privileges to exploit the flaw; no additional conditions are required. The risk is that malicious users could alter site content or deplete server resources through excessive image processing. While the impact is bounded to the permissions of the authenticated user, the potential for media loss or service disruption makes timely remediation important.