What is the CVSS score of CVE-2026-15345?

CVE-2026-15345 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

ShortPixel Adaptive Images CVE-2026-15345

EUVD-2026-59903 MEDIUM

Missing Authorization (CWE-862)

2026-08-16 Wordfence

GHSA-6c4v-hv9q-25jc

WordPress Authentication Bypass Wordpress Plugin Shortpixel Adaptive Images Webp Avif Cdn Image Optimization Shortpixel

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible action handler; PR:L reflects minimum subscriber authentication; integrity-only impact on plugin configuration with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:20 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

MEDIUM 4.3

DescriptionCVE.org

The ShortPixel Adaptive Images - WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.

AnalysisAI

Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected product is identified via CPE cpe:2.3:a:shortpixel:shortpixel_adaptive_images_-_webp,_avif,_cdn,_image_optimization:*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) indicates the plugin executes privileged configuration-change actions without first verifying whether the requesting user holds sufficient permissions. The vulnerable code paths are publicly visible in the WordPress SVN repository within notice.actions.class.php (lines 16, 87, 566, 614) and notice.class.php (line 747), suggesting authorization gates are absent or bypassable in the plugin's notice and action handler layer. In WordPress's role hierarchy, subscriber is the lowest authenticated role - available to any registered site user - making the attack surface broad wherever user registration is open.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - a code change was committed to the WordPress plugin SVN repository at changeset 3625451 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3625451%40shortpixel-adaptive-images&new=3625451%40shortpixel-adaptive-images), but the exact tagged release version incorporating this fix is not confirmed from available data. WordPress administrators should update the plugin to the latest available version via the WordPress dashboard and verify the installed version exceeds 3.11.5. As a compensating control, disable open user registration (Settings > General > Membership) to eliminate the subscriber-level attack surface on sites that do not require it - this removes exploitation paths without functional trade-offs for most sites. Additionally, deactivating co-located target plugins (Autoptimize, WP Rocket, Imagify, LiteSpeed Cache, ShortPixel Image Optimizer) eliminates the cross-plugin configuration impact, though this trades off their functionality. API key rotation for the ShortPixel account is advisable if exploitation is suspected.