CVE-2026-15345

Name of the Vulnerable Software and Affected Versions ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization versions prior to 3.11.6

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can exploit this by using the causer parameter to modify the plugin's API key and account binding. Additionally, if third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, or LiteSpeed Cache are installed, their configuration options can also be modified.

Recommendations Update to a version newer than 3.11.5.