Authorization Bypass Vulnerability in ShortPixel Adaptive Images Plugin for WordPress

CVE-2026-15345

What is CVE-2026-15345?

The ShortPixel Adaptive Images plugin for WordPress is susceptible to an authorization bypass issue found in all versions up to and including 3.11.5. This vulnerability arises from the plugin's failure to adequately verify whether a user has the necessary permissions to perform specific actions. As a result, authenticated users with subscriber-level access and above can manipulate various settings associated with third-party plugins, including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache. The impact of this vulnerability is contingent upon the presence of these third-party plugins, as the unauthorized modifications can only affect their configurations when they are installed.

References