Is CVE-2026-56066 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56066 being exploited in the wild.

How severe is CVE-2026-56066?

Medium severity, with a CVSS score of 5.8, published 26 June 2026.

Which products and versions are affected?

ShortPixel Adaptive Images <= 3.11.4.

Is there a fix for CVE-2026-56066?

A patch was published on 2026-06-26: Fixed in version 3.11.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56066 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56066?

Check whether you run ShortPixel Adaptive Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56066: ShortPixel Adaptive Images unauthenticated arbitrary file deletion

Q: Is there a fix for CVE-2026-56066?

A patch was published on 2026-06-26: Fixed in version 3.11.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56066 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56066?

Check whether you run ShortPixel Adaptive Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56066 · Severity: medium · CVSS 5.8 · Published 2026-06-26

A vulnerability in the ShortPixel Adaptive Images plugin for WordPress allows unauthorized individuals to delete files from a website's server. This plugin is typically used to optimize and serve images efficiently; however, an exploit could lead to the deletion of critical website files, potentially causing the site to crash or stop functioning entirely. This issue can be exploited remotely without needing any login credentials.

Vendors: ShortPixel.

Quick answers

Is CVE-2026-56066 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56066 being exploited in the wild.
How severe is CVE-2026-56066?: Medium severity, with a CVSS score of 5.8, published 26 June 2026.
Which products and versions are affected?: ShortPixel Adaptive Images <= 3.11.4.
Is there a fix for CVE-2026-56066?: A patch was published on 2026-06-26: Fixed in version 3.11.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56066 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56066?: Check whether you run ShortPixel Adaptive Images at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ShortPixel Adaptive Images plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in versions up to and including 3.11.4. This is caused by improper limitation of a pathname to a restricted directory (CWE-22), commonly known as path traversal. An attacker can exploit this by sending a specially crafted network request to the server, allowing them to delete files outside of the intended directory. This can lead to a denial-of-service condition if critical system or application files are removed. The vulnerability is resolved in version 3.11.5.

Affected products

ShortPixel ShortPixel Adaptive Images <= 3.11.4

Timeline

2026-06-12: other: Vulnerability reported by researcher
2026-06-25: advisory: Patchstack published advisory
2026-06-26: disclosed: CVE published to NVD
2026-06-26: patched: Fixed in version 3.11.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.