Josh Bolding

**Name of the Vulnerable Software and Affected Versions** ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6 **Description** The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with author-level permissions or higher to inject a PHP Object. While the software itself lacks a known POP chain (Property-Oriented Programming, a technique used to execute code by leveraging existing classes in the application), the issue becomes critical if another installed plugin or theme provides one. In such cases, an attacker could delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF to version 6.5.6 or later.