PT-2026-49377 · Shortpixel · Shortpixel Image Optimizer

Published 2026-06-15 · Updated 2026-06-16 · CVE-2026-39471

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShortPixel Image Optimizer versions prior to 6.4.4

Description PHP Object Injection occurs in the software. This issue allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other system compromises.

Recommendations Disable the plugin immediately. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-39471

Affected Products

Shortpixel Image Optimizer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39471 · Security Note
• https://patchstack.com/database/wordpress/plugin/shortpixel-image-optimiser/vulnerability/wordpress-shortpixel-image-optimizer-plugin-6-4-3-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/HugoValters/status/2067012845402001917 · Twitter Post