ShortPixel Adaptive Images EUVD-2026-59903

Exploitation requires an authenticated WordPress session with at minimum subscriber-level role - the lowest role assigned to any registered user. Sites with open user registration are directly exposed to unauthenticated visitors who can self-register. The primary impact (API key and account binding modification) requires no additional conditions beyond authentication. Secondary impact against third-party plugin settings (Autoptimize, WP Rocket, Imagify, LiteSpeed Cache, ShortPixel Image Optimizer) is only reachable when those specific plugins are installed and active on the same WordPress instance. Exploitation is not possible by unauthenticated visitors. Sites with closed registration or no subscriber-level accounts are not exposed without prior credential compromise.

CVSS 4.3 (Medium) accurately reflects constrained real-world risk: PR:L requires at minimum subscriber-level authentication, S:U limits blast radius to the same WordPress instance, and C:N/A:N confirm no direct data disclosure or service disruption. The most impactful outcome - overwriting the ShortPixel API key - could redirect API quota or disrupt image delivery, but this falls short of code execution. The additional third-party plugin impact (WP Rocket, Autoptimize, Imagify, LiteSpeed Cache) is gated behind those plugins being installed, further narrowing the realistic attack surface. No EPSS score was provided; KEV status is absent, meaning no confirmed active exploitation is known. The primary risk scenario is a malicious or compromised low-privilege account on a site with open registration. No conflicting signals are present between the CVSS vector and the description.

An attacker registers a subscriber account on a WordPress site running ShortPixel Adaptive Images ≤ 3.11.5 and sends a crafted authenticated POST request to one of the unprotected notice action handlers. The handler executes without verifying the caller's privilege level, allowing the attacker to overwrite the ShortPixel API key with an attacker-controlled value, disrupting image optimization services or redirecting API usage. No public POC is known at time of analysis, though the vulnerable code paths are publicly browsable in the WordPress plugin SVN repository.