CVE-2026-15345
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The ShortPixel Adaptive Images plugin for WordPress up to version 3.11.5 is vulnerable to authorization bypass. Improper verification of user permissions allows authenticated attackers with subscriber-level access and above to modify configuration options of third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding.
Risk Assessment
An attacker can alter the configuration of other plugins, potentially leading to security breaches, disabling protections, or API account takeover, and ultimately compromising the entire site.
Recommendation
Update the ShortPixel Adaptive Images plugin to the latest patched version. Restrict admin panel access and consider removing unused plugins that could be targeted.
Original NVD description (English source)
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.