CyberRota Analysis
AI-GeneratedThe ShortPixel Adaptive Images plugin for WordPress is vulnerable to an authorization bypass, allowing authenticated attackers with subscriber-level access or higher to alter configuration settings of third-party plugins, including ShortPixel Image Optimizer and WP Rocket, as well as the plugin's API key. This vulnerability poses a medium risk, particularly for sites utilizing the affected third-party plugins, as it could lead to unauthorized changes that compromise site functionality and security. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.