Executive brief
ShortPixel Image Optimizer is a WordPress plugin that optimizes and converts images to modern formats like WebP and AVIF. The plugin contains a PHP object injection vulnerability that allows authenticated authors and higher to inject malicious objects. While the vulnerability itself is limited without additional code chains, the presence of related plugins or themes on the same site could enable attackers to delete files, steal data, or execute arbitrary code.
Technical details
The vulnerability is a PHP Object Injection (CWE-502) caused by unsafe deserialization of untrusted input in the ShortPixel Image Optimizer plugin. The vulnerability is reachable by authenticated users with author-level access or higher, meaning an attacker must first compromise or impersonate a valid account. The injected PHP object itself has no direct impact within ShortPixel; however, if a gadget chain (POP chain) exists in any other installed plugin or theme, an attacker can leverage it to delete files, exfiltrate sensitive data, or achieve remote code execution. Patches are available in versions after 6.5.5.
Affected products
- ShortPixel ShortPixel Image Optimizer up to and including 6.5.5
Timeline
- 2026-09-18: disclosed
- 2026-09-18: advisory