davidanderson WP-Optimize Plugin up to 4.5.0 on WordPress Heartbeat class-wp-optimize-heartbeat.php receive_heartbeat authorization

Summaryinfo

A vulnerability identified as problematic has been detected in davidanderson WP-Optimize Plugin up to 4.5.0 on WordPress. Affected by this issue is the function receive_heartbeat of the file includes/class-wp-optimize-heartbeat.php of the component Heartbeat Handler. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2026-2712. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in davidanderson WP-Optimize Plugin up to 4.5.0 on WordPress. It has been rated as problematic. This issue affects the function receive_heartbeat of the file includes/class-wp-optimize-heartbeat.php of the component Heartbeat Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is integrity, and availability. The summary by CVE is:

The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).

The weakness was disclosed by Dmitrii Ignatyev. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-2712 since 02/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:includes/class-wp-optimize-heartbeat.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.4.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• davidanderson

Name

• WP-Optimize Plugin

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion