The WP‑Optimize plugin contains a flaw in the unscheduled_original_file_deletion function, where insufficient validation of file paths allows deletion of any file on the server. This action can remove critical files such as wp‑config.php, potentially providing an attacker with a path to remote code execution. The weakness is a classic directory traversal flaw (CWE‑22) that gains power through improper handling of the public meta key "original‑file".

Version 4.5.2 and all earlier releases of the WP‑Optimize plugin from the vendor David Anderson are affected. Any WordPress installation running those versions of the plugin is vulnerable.

The CVSS score of 8.1 indicates a high severity vulnerability and the EPSS score is not available for this risk assessment. The plugin is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated user with author or higher privileges who can modify attachment post meta via the Edit Media interface or the REST API. Once such a user manipulates the "original-file" meta key, they can delete arbitrary files on the server, which may allow execution of arbitrary code if a sensitive file is targeted.