PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-97246 ShortPixel CVE debrief

The ShortPixel Image Optimizer plugin for WordPress, versions up to and including 6.5.5, is vulnerable to PHP Object Injection. This vulnerability arises from the deserialization of untrusted data, allowing an attacker to inject objects. The issue has a CVSS score of 4.9, indicating a medium severity level. Defenders should assess exposure and prioritize updates to mitigate this vulnerability. The vulnerability can be exploited by an attacker with low privileges, potentially leading to limited impact on confidentiality and integrity. Official sources, including the CVE Program and NIST NVD, provide details on the vulnerability. However, specific details about exploitation or victim

Vendor
ShortPixel
Product
ShortPixel Image Optimizer
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-30
Original CVE updated
2026-10-20
Advisory published
2026-09-30
Advisory updated
2026-10-20

Who should care

Defenders responsible for WordPress installations using the ShortPixel Image Optimizer plugin should assess exposure and prioritize updates to mitigate this vulnerability. Given the medium severity, defenders should verify inventory and consider compensating controls until an update is applied.

Why it matters

CVE-2026-97246 is a medium-severity vulnerability in the ShortPixel Image Optimizer plugin for WordPress, allowing PHP Object Injection due to deserialization of untrusted data. Defenders should prioritize updating affected versions and assess exposure in their WordPress deployments.

  • Verify plugin version and assess exposure in WordPress deployments
  • Update vulnerable plugin versions to prevent potential object injection
  • Monitor for potential exploitation attempts targeting this vulnerability

Technical summary

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to PHP Object Injection due to deserialization of untrusted data. This issue affects versions up to and including 6.5.5. An attacker with low privileges can exploit this vulnerability, potentially leading to limited impact on confidentiality and integrity.

Defensive priority

Defenders should prioritize updating the ShortPixel Image Optimizer plugin to a version beyond 6.5.5 to mitigate this vulnerability. Given the medium severity and the requirement for low privileges, defenders should assess exposure and verify inventory, particularly for WordPress installations utilizing this plugin.

Recommended defensive actions

  • Update ShortPixel Image Optimizer plugin to version 6.5.6 or later
  • Verify inventory of WordPress installations utilizing the ShortPixel Image Optimizer plugin
  • Assess exposure based on plugin version and deployment context

Evidence notes

The CVE record and source item provide details on the vulnerability, including its CVSS score and affected versions. However, specific details about exploitation or victim impact are not provided, suggesting a need for verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-97246 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-97246

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-97246 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-97246

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.