CVE-2025-11378: ShortPixel Image Optimizer Auth Bypass

CVE-2025-11378 Overview

CVE-2025-11378 affects the ShortPixel Image Optimizer WordPress plugin, which provides image optimization and WebP/AVIF conversion. The vulnerability stems from a missing capability check on the shortpixel_ajaxRequest AJAX action. All plugin versions up to and including 6.3.4 are affected. Authenticated users with Contributor-level access or higher can invoke privileged actions, including exporting and importing site options. The flaw is classified as Missing Authorization [CWE-862].

Critical Impact
Low-privilege authenticated users can modify site configuration by exporting and importing plugin options through the unprotected AJAX endpoint.

Affected Products

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress
Versions up to and including 6.3.4
All WordPress installations with the affected plugin enabled

Discovery Timeline

2025-10-18 - CVE-2025-11378 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11378

Vulnerability Analysis

The ShortPixel Image Optimizer plugin exposes the shortpixel_ajaxRequest AJAX action through the WordPress AJAX handler. The handler dispatches to internal methods based on a client-supplied action parameter. Several branches perform administrative operations such as bulk restores, migrations, and option import/export. The plugin failed to enforce a capability check on all branches before executing the requested action.

Authenticated attackers with at least Contributor privileges can invoke these branches directly. Because WordPress AJAX endpoints are reachable by any logged-in user with a valid nonce, the missing server-side authorization check permits unauthorized modification of plugin state. Impact is limited to plugin option data rather than full site compromise.

Root Cause

The root cause is a missing capability check inside class/Controller/AjaxController.php. Individual case branches in the AJAX dispatcher did not call checkActionAccess($action, 'is_admin_user') before executing sensitive operations. WordPress capability enforcement must be performed per action, not assumed from the outer request context.

Attack Vector

An attacker authenticates to the target WordPress site with a Contributor account or higher. The attacker then issues a POST request to admin-ajax.php targeting the shortpixel_ajaxRequest action with a payload that selects a privileged branch such as option import or export. The server executes the branch without verifying the caller's role.

php

// Security patch in class/Controller/AjaxController.php
// Adds capability enforcement to previously unprotected branches

				$this->checkActionAccess($action, 'is_admin_user');
				$json = $this->startRestoreAll($json, $data);
				break;
			case 'startBulkUndoAI':
				$this->checkActionAccess($action, 'is_admin_user');
				$json = $this->startUndoAI($json, $data);
				break;
			case 'startMigrateAll':
				$this->checkActionAccess($action, 'is_admin_user');
				$json = $this->startMigrateAll($json, $data);

Source: GitHub Commit 74263060

Detection Methods for CVE-2025-11378

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action=shortpixel_ajaxRequest originating from non-administrator sessions.
Unexplained changes to ShortPixel plugin option values in the wp_options table.
AJAX invocations of subactions such as startBulkUndoAI, startRestoreAll, or startMigrateAll from Contributor or Author accounts.

Detection Strategies

Correlate admin-ajax.php requests with the authenticated user role and alert when non-admin users invoke administrative subactions.
Review WordPress audit logs for plugin option export or import events tied to low-privilege accounts.
Monitor for anomalous option-value diffs following AJAX activity from Contributor-level users.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture AJAX action names, request parameters, and acting user IDs.
Forward web server access logs to a centralized log platform and build detections for shortpixel_ajaxRequest requests by role.
Track plugin version inventory across sites and flag installations at or below 6.3.4.

How to Mitigate CVE-2025-11378

Immediate Actions Required

Update the ShortPixel Image Optimizer plugin to the version that includes commit 74263060acafbaf63b4a34f339a8b0dc35f2cad9.
Audit all Contributor, Author, and Editor accounts and remove any that are unused or unrecognized.
Review ShortPixel plugin option values and restore expected configuration from a known-good backup if tampering is suspected.

Patch Information

The vendor addressed the vulnerability by adding checkActionAccess($action, 'is_admin_user') calls to previously unprotected branches of the AJAX dispatcher in class/Controller/AjaxController.php. See the WordPress Plugin Changeset and the Wordfence Vulnerability Report for details.

Workarounds

Deactivate the ShortPixel Image Optimizer plugin until it can be updated.
Restrict access to /wp-admin/admin-ajax.php for the shortpixel_ajaxRequest action at the web application firewall (WAF) layer.
Temporarily reduce user roles so that untrusted accounts do not hold Contributor privileges or above.

bash

# Example WAF rule concept: block shortpixel_ajaxRequest for non-admin sessions
# Adjust to your WAF's syntax and role-detection mechanism
SecRule ARGS:action "@streq shortpixel_ajaxRequest" \
    "id:1011378,phase:2,deny,status:403,log,\
     msg:'CVE-2025-11378 ShortPixel AJAX blocked for non-admin'"