CVE-2026-39471 HIGH

CVE-2026-39471: WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability

Vendor Shortpixel
Product ShortPixel Image Optimizer
Weakness CWE-502 · Unsafe deserialization
Published June 15, 2026
Last update June 15, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

Explanation of Vulnerability in Simple Terms

02Summary

ShortPixel Image Optimizer versions up to 6.4.3 contain a deserialization flaw that allows authenticated administrators to execute arbitrary PHP code on the site. An attacker with admin access can craft malicious serialized data that, when processed by the plugin, runs their own code with full site privileges. This requires high-level access but poses a complete compromise risk.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with administrator privileges.

Potential impact on your site

04Site Impact

A compromised admin account can fully compromise your site, including data theft, malware injection, and site takeover.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

June 15, 2026 CVE published
June 15, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-3328 Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts CVE-2026-27053 WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability CVE-2026-49781 WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability CVE-2026-7566 LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload CVE-2026-7635 coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field