NHR Database Cleaner & Optimizer – Revisions, Transients, Autoload & Options Manager
NHR Database Cleaner & Optimizer – Revisions, Transients, Autoload & Options Manager has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (100%).
The one issue recorded for NHR Database Cleaner & Optimizer – Revisions, Transients, Autoload & Options Manager has a vendor fix available, so running the current release closes it.
All of these findings were reported by Phan Trong Quan. NHR Database Cleaner & Optimizer – Revisions, Transients, Autoload & Options Manager is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-27301NHR Options Table Manager <= 1.1.2 - Authenticated (Admin+) PHP Object Injection
Read the full analysisVulnerability Records

NHR Database Cleaner & Optimizer – Revisions, Transients, Autoload & Options Manager
Author
Nazmul Hasan Robin
🚀 GitHub Repository – Found a bug or have a feature request? Let us know! 💬 Slack Community – Got questions or just want to chat? Come hang out with us on Slack! A WordPress database collects data it no longer needs: old post revisions, auto-drafts, trashed posts, spam comments, expired transients, meta left behind by deleted content, and options and tables left behind by plugins you removed. This plugin shows you all of it, lets you preview exactly what would be deleted, and cleans it up on demand or on a schedule. It is a database cleaner and optimizer, not a malware scanner: it removes unused data, it does not look for malicious code. <?php echo 'Small database, fast site.'; ?> 🚀 Everything in One Place Cleanup, table optimization, a scheduled-events (cron) manager, and the deepest wp_options and autoload tools available: a tracker that finds autoloaded options your site never actually reads, per-option history with one-click restore, and automatic snapshots before risky changes. ✨ Key Features Database Cleanup – Remove post revisions, auto-drafts, trashed posts, spam, trashed and pending comments, pingbacks and trackbacks, orphaned post/comment/term/user meta, duplicate meta, orphaned term relationships, oEmbed caches, expired transients, and content left behind by post types that no longer exist. Every type shows a live count. Preview Before You Delete – See exactly which rows a cleanup would remove, and keep the last N days of anything with a date. Scheduled Cleanups – Give each cleanup type its own schedule (hourly, twice daily, daily, weekly or monthly) with its own keep-the-last-N-days rule. No limit on the number of schedules. Action Scheduler Cleanup – Clear finished, failed and canceled actions and their logs (WooCommerce and many other plugins fill these tables). Tables: Sizes, Optimize, Repair – Every database table with its rows, size, overhead and engine. Optimize and repair tables, convert MyISAM to InnoDB, and find tables left behind by removed plugins; those can be emptied or dropped after you type the table name to confirm. Scheduled Events (Cron) Manager – See every scheduled event with its next run and owner, run one now, delete it, and spot events that may belong to plugins you removed. Database Health Dashboard – An at-a-glance scorecard (0–100) with database size, autoload size, cleanable rows, transient and orphan counts and last backup, with prioritized one-click recommendations. Activity Log – A recent-activity summary on the Dashboard plus a dedicated, searchable and filterable Activity tab showing every change and who made it. The log keeps the latest 300 changes within your retention period. No Extra Tables – The plugin adds no database tables of its own. Its history and snapshots are stored as non-autoloaded options with fixed size limits, and all settings live in a single option. Modern React Interface – A fast, dashboard-first admin app organized into Dashboard, Browse, Optimize, Tools, Integrations, and Settings. Autoload Usage Tracker – Records which autoloaded options are actually used on real front-end page loads, then flags the ones that are never used so you can safely turn off their autoload; filter the list by usage status and bulk-disable every unused option at once. Autoload Health Check – Analyze total autoloaded data size and identify heavy options that slow down your site. Transients Manager – Dedicated view of every transient with size, expiration, status, and its guessed owner (a plugin, theme, or WordPress core); filter by status or owner, add and edit values (with expiration) directly, and select rows to bulk delete. Manage Options – Add, edit, and delete options with sortable columns, search, pagination, and bulk delete; filter the list by guessed owner (a plugin, theme, or WordPress core). Usermeta, Postmeta, Commentmeta & Termmeta Support – Browse, add, edit, and delete user, post, comment, and term meta entries just like options; narrow usermeta or postmeta to a single user or post by searching its name/title in a type-ahead picker. On multisite, user meta (shared by every site in the network) is available only to network administrators. Serialized Data Handling – Serialized and JSON values open as structured data you can edit safely, and are saved back in their original format. Scheduled Backups & Snapshots – Create restorable snapshots of your wp_options table manually or on a daily/weekly schedule, with automatic snapshots taken before Search & Replace and Import. Snapshots are compressed and skip transients, so they stay a small fraction of the table they protect; a scheduled snapshot is skipped when nothing has changed. The latest 15 are kept (the oldest is removed automatically), and the Backups panel shows how much space they use. Option History & Rollback – Every option edit and delete is recorded with its previous value. Open any option’s History from its row in Browse, or use the Activity tab, and restore a previous version in one click. Orphan Scanner – Find and clean up leftovers from uninstalled plugins. Options Table Analytics – See every option grouped by its name prefix with a row count, sorted highest first, so you can spot which plugin’s options weigh the most on your wp_options table. History Retention – Keep the change history for as many days as you choose, pruned daily or on demand with “Prune history now”. Settings shows how many entries the history holds and how much space it uses. Global Search & Replace – Safely replace strings across the options table, with a live count of matching options as you type and a dry-run preview that lists every match. Import / Export – Export every option, or search and pick just the ones you need. Import shows a preview first (new, modified, unchanged or protected, with the current value) so you choose exactly which options to bring in; files are checksum-verified, and exports from older versions import too. Integrations – Browse third-party plugin tables (WP Recipe Maker ratings, analytics and changelog; Better Payment) from the same interface with search and sortable columns. Tables whose plugin is no longer active are flagged. Allow HTML in Option Values – Off by default: HTML is stripped from option values you add or edit. Turn it on to store values exactly as entered. Follows WordPress’s own rule: only users allowed to save unfiltered HTML can store it. Core Option Protection – WordPress core options can’t be deleted by accident. Multisite Ready – Network-activate it and every site gets its own Database Cleaner for its own data, history, snapshots and schedules. A Network Admin screen lists every site with its database and autoload size, and lets network administrators browse and clean network-wide options and site transients. User meta, which is shared across the network, is limited to network administrators, and uninstalling cleans up every site. WP-CLI Support – wp nhrotm list and delete for options, wp nhrotm cleanup list and cleanup run <type> [--older-than=<days>] [--dry-run] for cleanups, and wp nhrotm tables list and tables optimize. Every list takes --format=json. The earlier wp nhr-options command name still works. AI Agent & MCP Ready – On WordPress 6.9 and later the plugin registers its features with the WordPress Abilities API, so AI agents and MCP clients (through the WordPress MCP Adapter) can read the health score, cleanup counts, autoload report, tables and cron events, preview a cleanup, and run the safe actions: a cleanup (dry run by default), disabling autoload for an option, optimizing a table and taking a snapshot. Administrators only. Option values are never returned, and nothing irreversible beyond a cleanup is offered. ⚡ Easy Installation & Instant Setup No complex configurations needed! Just install, activate, and head to Tools → Database Cleaner for the dashboard-first interface. 🎯 Safe by Design WordPress core options, tables and scheduled events are protected. Cleanups show a count and a preview before anything is deleted, options changes can be restored from history, and a snapshot of your options is taken automatically before Search & Replace and Import. Cleanups of posts, comments and meta cannot be undone from the plugin, so keep a full database backup as you would before any maintenance.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C