PT-2026-31845 · Unknown+1 · Updraft Smush Manager Commands+1

Dmitry Ignatyev · Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-2712

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP-Optimize plugin for WordPress versions up to and including 4.5.0

Description The WP-Optimize plugin for WordPress has a flaw that allows unauthorized access to functionality. This is due to missing capability checks in the receive heartbeat() function within the includes/class-wp-optimize-heartbeat.php file. The Heartbeat handler directly invokes Updraft Smush Manager Commands methods without proper verification of user capabilities, nonce tokens, or a command whitelist. This allows authenticated attackers with Subscriber-level access or higher to perform admin-only Smush operations, including reading log files via the /api/v1/smush/logs endpoint, deleting all backup images using the clean all backup images() function, triggering bulk image processing with the process bulk smush() function, and modifying Smush options through the update smush options() function.

Recommendations Update to a version of the WP-Optimize plugin later than 4.5.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-2712

Affected Products

Updraft Smush Manager Commands

Wp-Optimize

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2712 · Security Note
• https://twitter.com/CVEnew/status/2042561804614939096 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.4.1/includes/class-wp-optimize-heartbeat.php#L65 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6a0a376e-ea3a-40ca-9341-f28f92e15e02?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-optimize/trunk/includes/class-wp-optimize-heartbeat.php#L65 · Note
• https://research.cleantalk.org/cve-2026-2712 · Note
• https://twitter.com/CVEarity/status/2042865100038770790 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-optimize/tags/4.4.1/includes/class-wp-optimize-heartbeat.php#L82 · Note