CVE-2026-17086

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF versions prior to 6.5.6

Description The plugin is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows authenticated attackers with author-level permissions or higher to inject a PHP Object. While the software itself lacks a known POP chain (Property-Oriented Programming, a technique used to execute code by leveraging existing classes in the application), the issue becomes critical if another installed plugin or theme provides one. In such cases, an attacker could delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF to version 6.5.6 or later.