# CVE-2026-17086: ShortPixel Image Optimizer PHP object injection

Source: https://junglewise.ai/threats/cve-2026-17086-shortpixel-image-optimizer-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-17086 · Severity: high · CVSS 8.8 · Published 2026-09-18

ShortPixel Image Optimizer is a WordPress plugin that optimizes and converts images to modern formats like WebP and AVIF. The plugin contains a PHP object injection vulnerability that allows authenticated authors and higher to inject malicious objects. While the vulnerability itself is limited without additional code chains, the presence of related plugins or themes on the same site could enable attackers to delete files, steal data, or execute arbitrary code.

Technologies: [ShortPixel Image Optimizer](https://junglewise.ai/threats/technologies/shortpixel-image-optimizer). Vendors: [ShortPixel](https://junglewise.ai/threats/vendors/shortpixel).

## Quick answers

**Is CVE-2026-17086 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17086 being exploited in the wild.

**How severe is CVE-2026-17086?** High severity, with a CVSS score of 8.8, published 18 September 2026.

**Which products and versions are affected?** ShortPixel Image Optimizer up to and including 6.5.5.

**Is there a fix for CVE-2026-17086?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-17086 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-17086?** Check whether you run ShortPixel Image Optimizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP Object Injection (CWE-502) caused by unsafe deserialization of untrusted input in the ShortPixel Image Optimizer plugin. The vulnerability is reachable by authenticated users with author-level access or higher, meaning an attacker must first compromise or impersonate a valid account. The injected PHP object itself has no direct impact within ShortPixel; however, if a gadget chain (POP chain) exists in any other installed plugin or theme, an attacker can leverage it to delete files, exfiltrate sensitive data, or achieve remote code execution. Patches are available in versions after 6.5.5.

## Affected products

- ShortPixel ShortPixel Image Optimizer up to and including 6.5.5

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: advisory

## References

- [https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php](https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php)
- [https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php](https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.5.1/build/shortpixel/replacer2/src/Replacer.php)

## Related threats

- [ShortPixel Image Optimizer PHP object injection](https://junglewise.ai/threats/cve-2026-97246-subscriber-php-object-injection-in-shortpixel-image-optimizer-6-5)
- [ShortPixel Image Optimizer PHP object injection](https://junglewise.ai/threats/cve-2026-39471-shortpixel-image-optimizer-php-object-injection)