What the vulnerability does
01Description
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Explanation of Vulnerability in Simple Terms
02Summary
ShortPixel Image Optimizer versions up to 6.4.2 contain a path traversal vulnerability that allows high-privilege users to read files outside the intended directory. An attacker with administrator or equivalent access can view sensitive files on the server by manipulating file paths. This does not affect file modification or system availability.
What an attacker can do
03Attacker Capabilities
Read arbitrary files on the server outside the plugin's intended directory.
Potential impact on your site
04Site Impact
An admin account compromise could expose sensitive configuration files, database credentials, or other private data stored on the server.
Conditions required to exploit
05Prerequisites
Attacker must have high-level privileges (administrator or equivalent role) on the site.
Key dates
06Disclosure timeline
February 5, 2026
CVE published
April 8, 2026
Record updated
