PHP Object Injection Vulnerability in ShortPixel Image Optimizer Plugin
CVE-2026-97246

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Shortpixel Image Optimizer
Vendor
CVE Published:
30 September 2026

What is CVE-2026-97246?

The ShortPixel Image Optimizer plugin for WordPress, in versions 6.5.5 and below, is affected by a PHP Object Injection vulnerability. This issue allows attackers to exploit improper input validation, potentially leading to unauthorized access to sensitive data or remote code execution. Properly updating the plugin is essential to mitigate this risk and enhance your website's security.

Affected Version(s)

ShortPixel Image Optimizer <= 6.5.5

References

https://patchstack.com/database/wordpress/plugin/shortpix...
vdb-entry

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Asim Alshaya | Patchstack Bug Bounty Program
.