Executive brief
ShortPixel Image Optimizer is a popular WordPress plugin used to compress and optimize website images to improve loading speeds. A security vulnerability in versions 6.4.3 and earlier allows an attacker with 'Author' level permissions to inject malicious code into the website. If successfully exploited, this could lead to full site takeover, data theft, or the deletion of website files.
Technical details
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to PHP Object Injection (CWE-502) in versions up to 6.4.3. This occurs due to the deserialization of untrusted input provided by a user with Author-level privileges. An attacker can exploit this by submitting specially crafted input that, when processed by the PHP unserialize() function, can trigger a POP (Property Oriented Programming) chain. Depending on the available classes within the environment, this can lead to remote code execution, file manipulation, or unauthorized database access. The vulnerability is patched in version 6.4.4.
Affected products
- ShortPixel ShortPixel Image Optimizer <= 6.4.3
Timeline
- 2026-02-25: other: Vulnerability reported by researcher daroo
- 2026-04-20: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: NVD publication date
- 2026-04-20: patched: Version 6.4.4 released to address the issue