Images Optimize and Upload CF7
Images Optimize and Upload CF7 has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 9.1, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Images Optimize and Upload CF7 has a vendor fix available, so running the current release closes it.
All of these findings were reported by cydave. Images Optimize and Upload CF7 is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2022-4101Images Optimize and Upload CF7 <= 2.1.4 - Missing Authorization to Arbitrary File Deletion
Read the full analysisVulnerability Records

Images Optimize and Upload CF7
Author
Damir Akhmedshin
Images Optimize and Upload CF7 is an extension plugin for Contact Form 7 plugin, that allows you to upload multiple images using drag-n-drop or simple “Browse” button, and compress them on the client’s side before sending it. If you want to save a user’s time and bandwidth on uploading large images, this plugin is perfect solution. Tested with Contact Form 7 version 6.1.6 Features Experimental HEIC/HEIF server-side processing via Imagick. Available only when your server’s ImageMagick installation includes HEIC/HEIF format support. Quick compression on the client’s side Save data by compressing it on the client’s side before sending to the server Automatically resize images to max 1920px (width or height) Maintains the aspect ratio of the images Fix image rotation issue when uploading images from Android an iOS (uses EXIF data) Highly customizable File type validation No limits on input file size Ajax upload Drag-n-drop or browse file Attach compressed files to emails Adapted to mobile design Customize file upload thumbnails and drag and drop area layouts Multiple shortcodes in one form Identify files by adding ID to the shortcode. The ID value will be used as a prefix in the filename Set the maximum uploaded files limit in global settings, or in the shortcode Save or remove all temporary files from the server after sending the form. But if you want to keep the files on the server, please, install Contact Form 7 Database Addon – CFDB7 plugin to access the files Supports Google Chrome, Mozilla Firefox, Microsoft Edge, Safari. Doesn’t support IE 11 and lower Limitations Transparent background in PNG files will become solid black Animated GIF files will only have 1st frame after compression Doesn’t support IE
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C