Shortpixel Adaptive Images Webp Avif Cdn Image Optimization
Monthly
Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.