Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Co…

A path traversal vulnerability (CVE-2026-42756) affects the QuickWebP WordPress plugin by Ludwig You, which is used for compressing, optimizing images, and converting to WebP format. The vulnerability allows attackers to traverse directories outside of restricted paths, potentially enabling arbitrary file deletion. All versions from unknown starting point through version 3.2.7 are affected. The issue stems from improper limitation of pathnames to restricted directories. This affects the QuickWebP - Compress / Optimize Images & Convert WebP | SEO Friendly plugin.