Description

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-16T06:16:50.493Z",
  "pubdate": "2026-08-16T06:16:50.493Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress across all versions up to, and including, 3.11.5. This security flaw stems from insufficient capability and privilege verification checks when processing administrative actions within the plugin.\nThe vulnerability allows authenticated attackers holding low-privileged subscriber-level access to arbitrarily modify configuration options belonging to the core plugin, its associated API key, account bindings, and several prominent third-party performance and optimization plugins.\nThe impacted third-party software includes ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache. Exploitation against these specific integrations strictly requires the respective third-party plugins to be installed and active on the targeted WordPress environment.\nThe primary risk implication is unauthorized tampering with critical site performance, caching, and image optimization settings, potentially leading to service degradation, misconfiguration, or unauthorized linking of the site to external third-party accounts. Because subscriber accounts can often be created via open registration, the attack surface includes unprivileged remote threat actors capable of establishing a baseline account on the platform.",
  "technicalDetails": "The root cause of the vulnerability lies in an improper authorization mechanism within the ShortPixel Adaptive Images plugin. The codebase fails to adequately validate whether the requesting user possesses the necessary administrative capabilities or appropriate authorization tokens before executing sensitive configuration modification routines.\nThe vulnerable component involves the internal request handlers responsible for processing settings updates and administrative state modifications. Because privilege verification routines are absent or improperly implemented, requests initiated by a low-privileged session are processed as if they originated from an authorized administrator.\nThe affected versions comprise all iterations of the ShortPixel Adaptive Images plugin up to, and including, version 3.11.5. The required authentication level is authenticated access, and the minimum privilege requirement is exceptionally low, specifically subscriber-level access. Network exposure is standard web-facing, accessible via HTTP/HTTPS protocols common to WordPress installations.\nThe attack flow proceeds through the following sequence: First, an attacker establishes a subscriber-level account on the target WordPress instance, either through open user registration or via compromised low-privileged credentials. Second, the attacker crafts an HTTP request directed at the vulnerable endpoints within the ShortPixel Adaptive Images plugin, targeting specific configuration update functions.\nThird, the attacker injects parameters designed to alter the plugin's internal state, such as modifying the stored API key, altering account binding configurations, or targeting integration settings for installed third-party caching and optimization plugins.\nFourth, upon receiving the request, the vulnerable plugin processes the input parameters without enforcing adequate user capability checks. Finally, the post-exploitation impact is realized as the targeted configuration options are successfully overwritten or updated. If third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, or LiteSpeed Cache are present in the environment, their respective configuration settings are similarly manipulated, potentially disrupting caching mechanisms, optimization pipelines, or site availability."
}