WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts vulnerability

Unauthenticated Post Meta Injection on Submitted Posts vulnerability discovered by Dion Mulaj in WordPress Plugin Forminator versions 1.57.2.1...

CVE-2026-5821

The CVE-2026-5821 entry details a vulnerability in the WordPress Image Optimizer plugin (versions up to 1.7.4). The root cause is insufficient path validation in Image_Backup::remove(), where backup file paths stored in the image_optimizer_metadata post meta are used directly for deletion without...

CVE-2026-5821 Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the ImageBackup::remove function where backup file paths stored in post meta are used directly in file deletion operations withou...