Optimized-images polling crashes on `WP_Error` responses

[pirate-bot]

Summary

The Optimole optimized-images polling endpoint can terminate with Cannot use object of type WP_Error as array when its upstream image-statistics request returns an error.

Expected behavior: polling returns a valid REST error or empty result when the image-statistics request cannot provide image data.

Actual behavior: the REST request crashes before returning a response.

Impact: affected dashboard image-polling requests fail instead of reporting the upstream failure.

Customer context

• Product / area: Optimole WordPress plugin, optimized-images REST polling
• Version: 4.2.11
• Environment: WordPress 7.0.4 and 7.1; PHP 7.4.33, 8.1.34, and 8.3.33
• Reported error / symptom: Error: Cannot use object of type WP_Error as array
• Impact: 3 telemetry occurrences across 3 distinct production sites between 2026-08-27 and 2026-08-30.

Reproduction notes

1. Make an authenticated request to the optimized-images polling REST endpoint.
2. Cause the underlying image-statistics API request to return a WP_Error, such as a transport failure or a non-200 API error payload.
3. In 4.2.11, telemetry and source inspection indicate the callback reaches array access on that error object and terminates with Cannot use object of type WP_Error as array.

Runtime reproduction was not performed; production telemetry supplies the observed failure and source inspection confirms the reachable type mismatch.

Diagnosis

Conclusion

Production telemetry pinpoints Optml_Rest::poll_optimized_images() at inc/rest.php:712. The callback indexes $images as an array, while its immediate API method explicitly permits WP_Error; the API request path returns that object for transport failures and certain non-success API responses. This directly explains the captured error.

Where this likely occurs

• inc/rest.php — Optml_Rest::poll_optimized_images() lines 708-716 invokes Optml_Api::get_optimized_images() and accesses $images['list'] at line 712 before establishing that the result is an array. The telemetry location resolves to this line.
• inc/api.php — Optml_Api::get_optimized_images() lines 344-354 forwards the /optml/v1/stats/images request and documents array|bool|WP_Error as its return contract.
• inc/api.php — Optml_Api::request() lines 175-178 returns a transport WP_Error unchanged; lines 193-228 creates WP_Error for non-200 API responses that include an error payload.
• inc/rest.php — Optml_Rest::register_route() lines 189-232 wires the named callback into the authenticated REST route. v4.2.11 contains the same unchecked access at lines 708-716.

Engineering notes

• The affected request is a dashboard REST surface: poll_optimized_images is declared as a GET image route in inc/rest.php line 80 and receives the API result through the image-statistics endpoint.
• The evidence covers error objects returned from the plugin API layer. It does not establish which upstream condition occurred on each telemetry site.
• The crash is in plugin code, not the bundled Themeisle SDK, matching the telemetry classification.
• Git history shows the array assumption predates the current release. Although the API method later documented the broader WP_Error contract, the available evidence does not establish a previously working released version for this user-visible path.

Test coverage status

No relevant coverage was found during inspection. The PHP test suite contains no reference to poll_optimized_images, get_optimized_images, or stats/images; no endpoint test covering transport or API WP_Error results was identified.

What to verify or explore next

• Reproduce an authenticated optimized-images polling request while the API layer returns a transport WP_Error.
• Reproduce the endpoint with a non-200 image-statistics API payload containing an error field.
• Run the PHP test suite after adding or locating coverage for this endpoint's non-array return paths.

Unknowns / follow-up

• The telemetry report does not contain the upstream HTTP response, API error code, or request URL.
• No earlier release was runtime-tested, so a release-to-release regression boundary is unknown.

Confidence

Confidence: 99/100

Production telemetry records the same uncaught REST exception on three sites, and the released 4.2.11 callback indexes a documented WP_Error return value without a type check.

Crash telemetry

Occurrences	3
Distinct sites	3
First seen	2026-08-27 08:06 UTC
Last seen	2026-08-30 02:30 UTC
Crash location	product:inc/rest.php:712
Request context	rest
Inside Themeisle SDK	no
Product versions	4.2.11
WP versions	7.0.4, 7.1
PHP versions	7.4.33, 8.1.34, 8.3.33
SDK versions	3.3.58

---

Source: automated crash report — optimole-wp, fingerprint 6dabae4d17218c5ca4e67dd57933cc33
Generated by bug-report-triage (ID: bug-report-triage_6a9518fec247c0.00644249)