Cpe:2.3:a:shortpixel:shortpixel_image_optimizer:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ashortpixelshortpixel_image_optimizerwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 06:03:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-17086 PHP Object Injection in ShortPixel Image Optimizerhttps://feed.craftedsignal.io/briefs/2026-09-shortpixel-php-injection/Fri, 18 Sep 2026 06:03:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-shortpixel-php-injection/Authenticated attackers can exploit insecure deserialization in ShortPixel Image Optimizer versions 6.5.5 and below to execute arbitrary code if a POP chain is available via other plugins or themes.ShortPixel Image Optimizer for WordPress, version 6.5.5 and below, contains a PHP Object Injection vulnerability resulting from insecure deserialization of untrusted input. The flaw enables authenticated users with author-level access or higher to supply malicious serialized objects to the application. While the ShortPixel plugin does not inherently contain a Property Oriented Programming (POP) chain required to trigger exploitation, the vulnerability relies on the presence of secondary plugins or themes installed on the same WordPress instance that do contain a usable POP chain. If such a chain exists, an attacker could potentially achieve remote code execution, arbitrary file deletion, or sensitive data exfiltration. The severity of this issue is dependent on the overall plugin ecosystem of the host environment.

Impact

Successful exploitation requires an authenticated attacker with at least author-level permissions and the presence of a separate vulnerable plugin or theme. Impact varies based on the discovered POP chain but may result in total site compromise, including unauthorized file system access or remote code execution. The scope of impact is limited to the WordPress environments where this specific combination of vulnerable plugin and secondary exploit chain exists.

Recommendation

Update the ShortPixel Image Optimizer plugin to the latest available version beyond 6.5.5 to mitigate the deserialization vulnerability. Audit the WordPress environment to remove unused plugins and themes that may contain POP chains. Prioritize remediation based on the exposure of the administrative or author-level account interfaces and the overall plugin/theme attack surface.

]]>highadvisorywordpressvulnerabilityphp-injectiondeserialization