# ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.6 - Unauthenticated Sensitive Information Exposure and Log Deletion via Debug Mode

- **ID:** WPSEC-2026-3102
- **Plugin:** ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization (`shortpixel-adaptive-images`), https://wordpress.org/plugins/shortpixel-adaptive-images/
- **Affected versions:** all versions before 3.12.0
- **Fixed in:** 3.12.0 (Update to 3.12.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/shortpixel-adaptive-images
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3102/

## Description

The ShortPixel Adaptive Images plugin for WordPress is vulnerable to unauthorized access to its debug mode in all versions up to, and including, 3.11.6 due to the plugin honouring the 'SHORTPIXEL_AI_DEBUG' query parameter without any capability check. This makes it possible for unauthenticated attackers to enable PHP error display and full error reporting, exposing file paths and other internal data in responses, to turn on verbose debug logging, and to clear the plugin's debug log by passing 'SHORTPIXEL_AI_DEBUG=delete'.

## References

- https://wpsec.com/vuln/WPSEC-2026-3102/
- https://plugins.svn.wordpress.org/shortpixel-adaptive-images/tags/3.12.0/
- https://wordpress.org/plugins/shortpixel-adaptive-images/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3102/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.