Medium severity · published Feb 5, 2026
CVE-2026-1246
ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
4.9
CVSS
0.6%
EPSS
No
On KEV
Description
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF · shortpixel
through 6.4.2 · source: vendor
Affected product
SI
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
shortpixel
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1246
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L1686
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L309
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/BulkController.php#L200
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449706%40shortpixel-image-optimiser&new=3449706%40shortpixel-image-optimiser&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/03cb41d2-67c8-457f-8d85-7aede8e12d44?source=cve
More from ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
8.8
CVE-2026-17086
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
5.4
CVE-2026-4335
ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
5.4
CVE-2025-11378
ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export