What is the CVSS score of EUVD-2026-39719?

EUVD-2026-39719 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

ShortPixel Adaptive Images EUVD-2026-39719

| CVE-2026-56066 MEDIUM

Path Traversal (CWE-22)

2026-06-26 audit@patchstack.com

GHSA-v6hj-467c-2chv

WordPress Path Traversal Wordpress Plugin

5.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

vuln.today AI

7.2 HIGH

Network-accessible, unauthenticated, zero-interaction; I:L assigned because file deletion constitutes integrity loss, contradicting the provided I:N; A:L retained given apparent non-arbitrary scope constraint.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:20 vuln.today

DescriptionCVE.org

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

AnalysisAI

Unauthenticated path traversal file deletion affects ShortPixel Adaptive Images WordPress plugin versions 3.11.4 and earlier, allowing remote attackers without any credentials to delete files outside the plugin's intended directory scope. The CVSS vector (PR:N, AC:L, S:C) confirms no authentication is required and that the impact crosses component boundaries, potentially reaching WordPress core files or other hosted content. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward once the vulnerability is known.

Technical ContextAI

ShortPixel Adaptive Images is a WordPress plugin (wordpress/shortpixel-adaptive-images) that performs server-side image optimization and adaptive delivery. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): user-supplied input is passed to a file deletion routine without adequate sanitization, allowing directory traversal sequences (e.g., '../../../') to escape the intended plugin working directory. The changed scope (S:C in the CVSS vector) indicates the traversal can reach files belonging to other WordPress components or the broader filesystem, not just the plugin's own cache. Notably, the Patchstack advisory URL references 'non-arbitrary file deletion,' suggesting the reachable file paths may be constrained to a subset of the filesystem rather than fully arbitrary - a meaningful distinction for impact assessment.

RemediationAI

Upgrade ShortPixel Adaptive Images to version 3.11.5 or later. The fix version is inferred from the Patchstack advisory URL slug ('3-11-5'), which has not been independently confirmed via a separate vendor changelog in the provided data - administrators should verify the current plugin version in the WordPress repository before upgrading. The advisory is at https://patchstack.com/database/wordpress/plugin/shortpixel-adaptive-images/vulnerability/wordpress-shortpixel-adaptive-images-plugin-3-11-5-non-arbitrary-file-deletion-vulnerability?_s_id=cve. If immediate patching is not possible, a compensating control is to restrict unauthenticated HTTP access to the specific endpoint or parameter that triggers the deletion routine at the web server or WAF layer (block requests containing path traversal sequences such as '../' directed at plugin endpoints); note this may break legitimate plugin functionality and should be tested in staging first.