CVE-2026-1246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1246", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-20T18:53:28.652Z", "datePublished": "2026-02-05T06:47:41.372Z", "dateUpdated": "2026-04-08T16:33:01.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:01.074Z"}, "affected": [{"vendor": "shortpixel", "product": "ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys."}], "title": "ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03cb41d2-67c8-457f-8d85-7aede8e12d44?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L309"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L1686"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/BulkController.php#L200"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449706%40shortpixel-image-optimiser&new=3449706%40shortpixel-image-optimiser&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafa\u0142"}], "timeline": [{"time": "2026-01-20T19:08:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-04T18:35:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:55:50.898150Z", "id": "CVE-2026-1246", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:55:57.326Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1246", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T14:55:50.898150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:55:54.196Z"}}], "cna": {"title": "ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Rafa\u0142"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "shortpixel", "product": "ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-20T19:08:38.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-04T18:35:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03cb41d2-67c8-457f-8d85-7aede8e12d44?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L309"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L1686"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/BulkController.php#L200"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449706%40shortpixel-image-optimiser&new=3449706%40shortpixel-image-optimiser&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:33:01.074Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1246", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:33:01.074Z", "dateReserved": "2026-01-20T18:53:28.652Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-05T06:47:41.372Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF", "vendor": "shortpixel", "versions": [{"lessThanOrEqual": "6.4.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys."}, {"lang": "es", "value": "El plugin ShortPixel Image Optimizer para WordPress es vulnerable a la lectura arbitraria de archivos a trav\u00e9s de salto de ruta en el par\u00e1metro 'loadFile' en todas las versiones hasta la 6.4.2, inclusive, debido a la validaci\u00f3n y saneamiento de ruta insuficientes en la acci\u00f3n AJAX 'loadLogFile'. Esto permite a atacantes autenticados, con acceso de nivel Editor o superior, leer el contenido de archivos arbitrarios en el servidor, que pueden contener informaci\u00f3n sensible como credenciales de base de datos y claves de autenticaci\u00f3n."}], "id": "CVE-2026-1246", "lastModified": "2026-06-17T10:15:23.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1246", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:55:50.898150Z", "version": "2.0.3"}}]}, "published": "2026-02-05T07:16:17.443", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L1686"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/AjaxController.php#L309"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/shortpixel-image-optimiser/tags/6.4.1/class/Controller/BulkController.php#L200"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449706%40shortpixel-image-optimiser&new=3449706%40shortpixel-image-optimiser&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03cb41d2-67c8-457f-8d85-7aede8e12d44?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T21:24:07.136231+00:00", "value": {"mitigation_remediation": ["Update ShortPixel Image Optimizer to the latest released version (at least 6.4.3).", "If an upgrade is not immediately possible, disable or restrict the \u2018loadLogFile\u2019 AJAX action for all users, or limit it to administrators only.", "Configure the server\u2019s file permissions to ensure that WordPress\u2019s web\u2011accessible directory does not permit reading of sensitive files such as wp-config.php."], "summary": {"action": "Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "WordPress sites running the ShortPixel Image Optimizer plugin of any version from the initial release through 6.4.2. The affected product is the ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP & AVIF plugin provided by ShortPixel.", "description_and_impact": "ShortPixel Image Optimizer versions up to 6.4.2 allow an authenticated attacker with Editor role or higher to read any file on the web server. The vulnerability arises from path\u2011traversal in an AJAX endpoint that receives a \u2018loadFile\u2019 parameter without proper validation or sanitization. An attacker can request sensitive files such as wp-config.php or .env, exposing database credentials, API keys and other secrets. The weakness is classified as CWE\u201122, a path traversal flaw that compromises confidentiality of arbitrary server files.", "risk_and_exploitability": "The CVSS base score of 4.9 indicates moderate severity; however, the exploitability is low as reflected by an EPSS score under 1%. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack vector relies on the user already having Editor\u2011level WordPress access; an attacker must authenticate and then send a crafted AJAX request targeting the vulnerable \u2018loadLogFile\u2019 action. Because of the path\u2011traversal logic, any file path can be resolved, allowing direct read of the server\u2019s file system within the webroot."}}}}, "created": "2026-02-06T12:05:50.800365+00:00", "updated": "2026-04-15T21:30:13.896018+00:00", "vendors": ["shortpixel", "shortpixel$PRODUCT$image_optimizer", "wordpress", "wordpress$PRODUCT$wordpress"]}