CVE-2026-15345 in Adaptive Images Plugin
Summary
by MITRE • 08/16/2026
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The ShortPixel Adaptive Images plugin for WordPress presents a critical authorization bypass vulnerability that affects all versions up to and including 3.11.5, creating a significant security risk for WordPress installations. This vulnerability stems from insufficient user authorization verification mechanisms within the plugin's codebase, allowing authenticated attackers with subscriber-level privileges or higher to execute unauthorized actions. The flaw specifically targets the plugin's configuration handling capabilities, enabling malicious users to manipulate settings across multiple third-party image optimization plugins that are commonly used in WordPress environments.
The technical implementation of this vulnerability demonstrates a clear failure in access control validation, where the plugin fails to properly authenticate user permissions before allowing modifications to critical configuration parameters. This authorization bypass occurs at the application level within the WordPress plugin architecture, where proper input sanitization and privilege checking mechanisms are absent or inadequately implemented. The vulnerability affects not only the plugin's own operational settings but also extends to configuration options of popular image optimization plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, creating a cascading security impact across multiple components of the WordPress ecosystem.
The operational impact of this vulnerability is substantial, as it provides attackers with the ability to modify core plugin configurations that directly affect website performance, image delivery methods, and caching strategies. When third-party plugins are installed, attackers can leverage this bypass to alter optimization settings that control how images are processed and delivered to end users, potentially degrading site performance or compromising security configurations. The vulnerability's reach extends to the plugin's own API key and account binding settings, which could enable attackers to gain unauthorized access to premium services or manipulate billing-related configurations.
Security professionals should note this vulnerability aligns with CWE-285, which addresses improper authorization in software applications, and maps to several ATT&CK tactics including privilege escalation and persistence mechanisms. The attack vector requires only authenticated access at the subscriber level, making it particularly dangerous as it can be exploited by users who have minimal administrative privileges within a WordPress environment. Organizations should immediately update to patched versions of the plugin or implement temporary mitigations such as restricting user roles or disabling unnecessary plugin functionality until updates are applied.
The broader implications for WordPress security highlight the importance of thorough access control validation in plugin development, particularly when dealing with configuration modifications that affect core site operations. This vulnerability demonstrates how third-party dependencies can create extended attack surfaces when proper authorization checks are not implemented across all plugin components. System administrators should conduct comprehensive security audits of their WordPress installations to identify other plugins with similar authorization bypass vulnerabilities and ensure that all software components maintain robust access control mechanisms to prevent unauthorized configuration modifications that could compromise site integrity and performance.