What is the CVSS score of CVE-2026-39471?

CVE-2026-39471 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ShortPixel Image Optimizer are affected by CVE-2026-39471?

The ShortPixel Image Optimizer WordPress plugin (versions 6.4.3 and earlier) contains an authenticated code execution vulnerability that allows users with Author-level privileges to compromise…

How to fix or mitigate CVE-2026-39471?

Within 24 hours: Inventory all WordPress installations and document ShortPixel plugin versions; immediately audit and restrict Author-level user access. Within 7 days: Monitor Patchstack and ShortPixel's official channels for security patches. Within 30 days: Apply vendor patch when released; if no patch becomes available, disable the plugin and migrate to an alternative image optimization solution.

ShortPixel Image Optimizer CVE-2026-39471

EUVD-2026-36935 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-8wj8-vcgv-j3hf

PHP Deserialization Shortpixel Image Optimizer

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint, no user interaction, full CIA impact via PHP object injection; Author is a low-privileged content role, so PR:L rather than PR:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:30 vuln.today

DescriptionCVE.org

Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

AnalysisAI

Authenticated PHP Object Injection in the ShortPixel Image Optimizer WordPress plugin (versions 6.4.3 and earlier) allows attackers with Author-level privileges to trigger unsafe deserialization of attacker-controlled data, enabling code execution or other impacts when a suitable PHP gadget chain is present. Reported by Patchstack with no public exploit identified at time of analysis, the flaw is tracked as CWE-502 and carries a CVSS 3.1 score of 7.2 due to the high-privilege prerequisite but full CIA impact.

Technical ContextAI

ShortPixel Image Optimizer is a widely deployed WordPress plugin that compresses and optimizes images via the ShortPixel API. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-influenced data into PHP's unserialize() (or an equivalent path), allowing crafted serialized objects to instantiate arbitrary classes and invoke magic methods such as __wakeup or __destruct. In WordPress environments, such gadgets are commonly found in core, Monolog, or other bundled libraries, and can be chained to achieve file write, SQLi, SSRF, or remote code execution. The CPE cpe:2.3:a:shortpixel:shortpixel_image_optimizer:*:*:*:*:*:*:*:* covers all builds up to and including 6.4.3.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the supplied data, so administrators should upgrade ShortPixel Image Optimizer to the latest version greater than 6.4.3 available on the WordPress.org plugin repository and verify the changelog references this PHP Object Injection fix (Patchstack advisory: https://patchstack.com/database/wordpress/plugin/shortpixel-image-optimiser/vulnerability/wordpress-shortpixel-image-optimizer-plugin-6-4-3-php-object-injection-vulnerability). Until upgraded, restrict Author role assignment to trusted users, disable open user registration or downgrade default new-user roles, and deploy a WAF rule (e.g., Patchstack/Wordfence virtual patch) to block serialized PHP payloads (strings matching patterns like O:\d+: and a:\d+:{) in plugin endpoints - note this may break legitimate features that legitimately transport serialized data. Audit existing Author accounts for unfamiliar users and rotate credentials; as a last resort, deactivate the ShortPixel Image Optimizer plugin, accepting loss of automated image optimization.