CVE-2026-39471: WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and chain them into destructive operations. This flaw affects the ShortPixel Image Optimizer WordPress plugin in versions 6.4.3 and earlier, and is reachable over the network by an authenticated user holding an Author-level account or higher. Successful exploitation enables full confidentiality loss, data tampering, and service disruption on the affected WordPress installation. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS from a remote location.

• AuthenticationRequired

  An Author-level WordPress account (or any higher-privilege role) is required, so the attacker must possess or obtain valid credentials before exploiting the flaw.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can trigger the vulnerable code path directly.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond holding a valid account.

Blast Radius

• A successful attacker can read sensitive data stored on the WordPress host, including database credentials, API keys, and stored user records.
• The attacker can modify or delete persisted data, including post content, plugin configuration, and database rows accessible to the PHP process.
• The attacker can crash or destabilize the WordPress service by triggering destructors that corrupt application state or exhaust server resources.
• Because all three impact dimensions (confidentiality, integrity, availability) score High, full compromise of the affected WordPress instance is within reach from a single exploitation chain.