CVE-2022-29417 MEDIUM

CVE-2022-29417: WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability

Vendor Shortpixel
Product ShortPixel Adaptive Images (WordPress plugin)
Weakness CWE-284
Published April 25, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings.

Explanation of Vulnerability in Simple Terms

02Summary

ShortPixel Adaptive Images for WordPress contains an access control flaw that allows authenticated users with low privileges to modify settings they should not have access to. The vulnerability affects versions up to 3.3.1. An attacker with a low-privilege account (such as a subscriber or contributor) can alter plugin configuration without proper authorization checks.

What an attacker can do

03Attacker Capabilities

Modify ShortPixel plugin settings that should be restricted to administrators.

Potential impact on your site

04Site Impact

Unauthorized users can change image optimization settings, potentially disrupting site functionality or exposing configuration details.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account (subscriber, contributor, or similar).

Key dates

06Disclosure timeline

April 25, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 CVE-2026-48906 Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla CVE-2026-48899 Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla CVE-2025-11163 SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update