PHP Object Injection Vulnerability in ShortPixel Image Optimizer Plugin for WordPress

CVE-2026-17086

What is CVE-2026-17086?

The ShortPixel Image Optimizer plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This vulnerability affects all versions up to 6.5.5 and allows authenticated attackers with author-level access to potentially inject malicious PHP objects. While no known PHP Object Pollute (POP) chain exists within the vulnerable software itself, the risk escalates significantly when the plugin is combined with other themes or plugins that do implement a POP chain, enabling attackers to execute harmful actions such as deleting files or accessing sensitive information.

References