The ShortPixel Image Optimizer plugin for WordPress is vulnerable to PHP Object Injection, which could lead to remote code execution or data loss if combined with compatible software components.

This vulnerability is a deserialization of untrusted data (CWE-502) affecting the plugin. It allows authenticated attackers with author-level access or higher to inject PHP objects, which may lead to severe system compromise if a property-oriented programming (POP) chain exists within the environment.

Successful exploitation poses a high risk to business operations, as it could facilitate unauthorized data retrieval, arbitrary file deletion, or remote code execution. With a CVSS score of 8.8, this vulnerability is considered high severity, as it impacts the confidentiality, integrity, and availability of the entire WordPress installation. The risk is compounded if the site relies on other plugins or themes that contain gadgets capable of forming a functional exploit chain.

Immediate Action: Since a specific fixed version is not explicitly provided in the data, administrators should monitor the official WordPress plugin repository for security updates and apply them as soon as they become available. If a patch is not yet released, consider temporarily deactivating the plugin to eliminate the attack surface.

Proactive Monitoring: Review WordPress user access logs to identify suspicious activity from accounts with author-level permissions or higher. Monitor system logs for unexpected file modifications or unauthorized execution attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious serialized PHP objects in incoming requests. Implement the principle of least privilege by restricting user roles to prevent unauthorized access to administrative or author-level functions.

Public Exploit Available: Unknown

The potential for remote code execution makes this vulnerability a significant security concern for WordPress administrators. Security teams must prioritize monitoring for updates to the ShortPixel Image Optimizer plugin and apply the latest version immediately upon release. Until a patch is confirmed, minimizing the number of installed plugins and themes can reduce the likelihood of a POP chain being available for an attacker to leverage.