The Image Optimizer plugin contains a flaw in the remove() routine where backup file paths stored in post meta are deleted without confirming they belong to the uploads folder. This insufficient path validation allows an authenticated user who can edit attachment custom fields to insert any absolute file path into the image_optimizer_metadata array. When the attachment is subsequently removed, the plugin deletes those listed paths verbatim, enabling deletion of arbitrary files on the server. The vulnerability is classified as CWE‑73 and can lead to data loss, service disruption, or compromise of other site content.

WordPress installations running the Elementor Image Optimizer – Optimize Images and Convert to WebP or AVIF plugin, versions 1.7.4 and earlier, are affected. Sites that grant author or higher roles the ability to edit custom fields for attachments are at risk.

The CVSS score of 8.1 indicates high severity, while an EPSS score of <1% shows that current exploitation is thought to be uncommon but possible. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker must have the capability to edit custom fields on attachments to inject malicious paths. Exploitation requires only author‑level access and occurs via a web‑based action after login, making it a realistic threat for sites where the plugin is active. The likely attack vector is a web‑based operation performed after a user’s session is normally sufficient to carry out the exploit.