Arbitrary File Deletion in Optimole Plugin for WordPress

CVE-2026-124969

What is CVE-2026-124969?

The Optimole plugin for WordPress is susceptible to arbitrary file deletion due to inadequate validation of file paths in the function replacing URLs with values. This vulnerability impacts all versions up to and including 4.2.19, and it allows unauthenticated users to delete files from the server. Successful exploitation could result in remote code execution, particularly if critical files like wp-config.php are deleted. An attacker must exploit this vulnerability through a two-step process: first, their malicious payload needs to be staged in a comment, and then an administrator's interaction with the plugin's file-renaming feature is required to trigger the deletion. This makes the vulnerability particularly concerning, as it necessitates both an insecure server setup and a specific action from an admin to exploit effectively.

References