{
 "id": "WPSEC-2026-3102",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3102/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3102/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3102/index.md",
 "title": "ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.6 - Unauthenticated Sensitive Information Exposure and Log Deletion via Debug Mode",
 "description": "The ShortPixel Adaptive Images plugin for WordPress is vulnerable to unauthorized access to its debug mode in all versions up to, and including, 3.11.6 due to the plugin honouring the 'SHORTPIXEL_AI_DEBUG' query parameter without any capability check. This makes it possible for unauthenticated attackers to enable PHP error display and full error reporting, exposing file paths and other internal data in responses, to turn on verbose debug logging, and to clear the plugin's debug log by passing 'SHORTPIXEL_AI_DEBUG=delete'.",
 "plugin": {
  "slug": "shortpixel-adaptive-images",
  "name": "ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization",
  "full_name": "ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization",
  "wordpress_org": "https://wordpress.org/plugins/shortpixel-adaptive-images/",
  "advisories_url": "https://wpsec.com/vuln/plugin/shortpixel-adaptive-images/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/shortpixel-adaptive-images"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.12.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.12.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.12.0",
 "remediation": "Update to 3.12.0 or later.",
 "fix_released": "2026-11-12T19:07:06+00:00",
 "published": "2026-11-13T19:41:14+00:00",
 "updated": "2026-11-13T15:54:47.715287+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3102/",
  "https://plugins.svn.wordpress.org/shortpixel-adaptive-images/tags/3.12.0/",
  "https://wordpress.org/plugins/shortpixel-adaptive-images/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/shortpixel-adaptive-images",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}