CVE-2026-56066
MediumCVSS 5.8Summary
The ShortPixel Adaptive Images plugin versions up to 3.11.4 contain a vulnerability allowing an unauthenticated attacker to delete arbitrary files on the server. The flaw is due to missing proper authorization and input validation.
Risk Assessment
An attacker can delete critical system files, configuration files, or application data, potentially leading to service disruption, data loss, or server compromise.
Recommendation
Immediately update the ShortPixel Adaptive Images plugin to version 3.11.5 or later. If an update is not possible, temporarily disable the plugin until a patch is applied.
Other vulnerabilities in ShortPixel Adaptive Images <= 3.11.4
See all- CVE-2026-57342Medium
The ShortPixel Adaptive Images plugin version 3.11.3 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. This allows a subscriber-level user to inject malicious JavaScript code into the page.
- CVE-2026-15345Medium
The ShortPixel Adaptive Images plugin for WordPress up to version 3.11.5 is vulnerable to authorization bypass. Improper verification of user permissions allows authenticated attackers with subscriber-level access and above to modify configuration options of third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding.
Original NVD description (English source)
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.