CVE Intelligence
Analysis AI-assisted

CVE-2026-42756: QuickWebP WordPress Plugin up to 3.2.7: Path Traversal with Arbitrary File Deletion

CVE-2026-42756 affects the QuickWebP image compression and WebP conversion plugin for WordPress in versions through 3.2.7, where a path traversal weakness (CWE-22) is reported. The record title describes the impact as arbitrary file deletion, and Patchstack rated it critical with a CVSS 3.1 score of 9.9. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CVE record describes a path traversal weakness (CWE-22) in the QuickWebP plugin for WordPress. Patchstack is the CNA for this record, which was published on 2026-05-27. The title refers to arbitrary file deletion, but the description itself only states the path traversal issue, so the exact deletion scope is not detailed.

Impact

  • Patchstack assigns a CVSS 3.1 base score of 9.9 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
  • The SSVC data in the record lists technical impact as total.
  • Per the record title, an attacker could delete arbitrary files. Inference: deletion of core or configuration files on a WordPress server could take a site offline or compromise its integrity.

Affected products and versions

  • The record names the Ludwig You QuickWebP plugin and lists the affected range as versions through 3.2.7.
  • The lower bound of the range is recorded as n/a, so the earliest affected version is unknown.
  • No fixed version is listed in the record. This does not mean that no fix exists.

Exploitation status

  • The record shows that this CVE is not listed in the CISA KEV catalog.
  • The SSVC exploitation value is none and the automatable value is no.
  • The EPSS probability is 0.00548, with a percentile of 0.44354.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every WordPress site that has the QuickWebP plugin installed and record its version.
  • Because the record lists no fixed version, check the Patchstack entry and the plugin's official distribution for a release that addresses this issue.
  • If no fixed release is confirmed, consider deactivating and removing the plugin until a fix is available.
  • Keep current, tested backups of site files and the database so that any deleted content can be restored.
  • Limit administrative access to WordPress and keep the core, themes and other plugins updated.

Detection guidance

  • Run file integrity checks on plugin, theme and upload directories and alert on missing or unexpectedly removed files.
  • Review web server and application logs for unusual requests directed at the QuickWebP plugin.
  • Investigate any unexpected site errors or missing content, since these may indicate file deletion.

Limitations of the available information

  • The record does not include technical details of the vulnerable code path or the privileges required beyond the CVSS vector.
  • The description does not mention file deletion, so that effect comes only from the record title.
  • The lower bound of the affected range is not specified.
  • No fixed version or vendor advisory is listed in the sources consulted.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so the EPSS value should be interpreted with caution.

Frequently asked questions

Is CVE-2026-42756 being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none.

Which versions of QuickWebP are affected?

The record lists versions through 3.2.7 as affected. The lower bound of the range is not specified.

Is there a fixed version?

The record does not list a fixed version. Check the Patchstack entry and the plugin's official distribution for a release that addresses the issue.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.