Vulnerabilities / ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization / WPSEC-2026-3102
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.6 - Unauthenticated Sensitive Information Exposure and Log Deletion via Debug Mode
Medium 6.5
CWE-862Fixed in 3.12.0
- ID
- WPSEC-2026-3102
- Plugin
- ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization (shortpixel-adaptive-images)
- Affected
- all versions before 3.12.0
- Remediation
- Update to 3.12.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization on WPSec AttackSurface
- Fix released
- Published
Description
The ShortPixel Adaptive Images plugin for WordPress is vulnerable to unauthorized access to its debug mode in all versions up to, and including, 3.11.6 due to the plugin honouring the 'SHORTPIXEL_AI_DEBUG' query parameter without any capability check. This makes it possible for unauthenticated attackers to enable PHP error display and full error reporting, exposing file paths and other internal data in responses, to turn on verbose debug logging, and to clear the plugin's debug log by passing 'SHORTPIXEL_AI_DEBUG=delete'.
References
- https://wpsec.com/vuln/WPSEC-2026-3102/
- https://plugins.svn.wordpress.org/shortpixel-adaptive-images/tags/3.12.0/
- https://wordpress.org/plugins/shortpixel-adaptive-images/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS