CVE-2026-1246: WordPress ShortPixel Path Traversal Flaw

CVE-2026-1246 Overview

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to an Arbitrary File Read vulnerability via path traversal in the loadFile parameter in all versions up to, and including, 6.4.2. This vulnerability exists due to insufficient path validation and sanitization in the loadLogFile AJAX action, allowing authenticated attackers with Editor-level access and above to read the contents of arbitrary files on the server.

Critical Impact

Authenticated attackers can leverage this path traversal vulnerability to read sensitive server files, potentially exposing database credentials, authentication keys, and other critical configuration data.

Affected Products

• ShortPixel Image Optimizer WordPress plugin versions up to and including 6.4.2
• WordPress installations with the vulnerable plugin enabled
• Web servers hosting affected WordPress instances

Discovery Timeline

• 2026-02-05 - CVE-2026-1246 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1246

Vulnerability Analysis

This vulnerability falls under CWE-22 (Path Traversal) and allows authenticated attackers to bypass intended directory restrictions. The flaw resides in the loadLogFile AJAX action within the plugin's AjaxController.php file. When processing the loadFile parameter, the application fails to properly validate and sanitize user-supplied input, enabling directory traversal sequences (such as ../) to escape the intended file path context.

The attack requires network access and authentication at the Editor privilege level or higher. While the authentication requirement provides some barrier to exploitation, WordPress sites with multiple users or compromised editor accounts remain at significant risk. The vulnerability specifically affects confidentiality, as attackers can read but not modify or delete files.

Root Cause

The root cause of this vulnerability is insufficient input validation and path sanitization in the loadLogFile AJAX action. The vulnerable code in AjaxController.php accepts a user-controlled loadFile parameter without adequately filtering path traversal sequences. This allows attackers to construct malicious file paths that traverse outside the intended log file directory to access sensitive files anywhere on the server's file system accessible to the web server process.

Attack Vector

The vulnerability is exploited via the network through an authenticated AJAX request to the WordPress site. An attacker with Editor-level privileges or higher can craft a malicious request to the loadLogFile AJAX action, supplying a specially crafted loadFile parameter containing directory traversal sequences. This allows navigation outside the plugin's intended directory to access files such as wp-config.php (containing database credentials), .htaccess files, or other sensitive configuration files on the server.

The attack does not require user interaction and can be executed with low complexity once the attacker has obtained valid credentials at the required privilege level. Technical details and vulnerable code locations can be found in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1246

Indicators of Compromise

• Unusual AJAX requests to the loadLogFile action containing path traversal sequences (../)
• Web server access logs showing requests with loadFile parameters containing traversal patterns
• Unexpected file access attempts in WordPress audit logs from Editor-level accounts
• Authentication events followed by AJAX requests targeting the ShortPixel plugin endpoints

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns in request parameters
• Implement file integrity monitoring to detect unauthorized access to sensitive configuration files
• Review WordPress user activity logs for suspicious AJAX requests from Editor accounts
• Deploy endpoint detection rules to identify path traversal attempt patterns

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX actions and review logs for anomalous patterns
• Configure alerting for access attempts to sensitive files like wp-config.php from web processes
• Audit Editor and Administrator account activities regularly for suspicious behavior
• Implement network-level monitoring for unusual outbound data transfers that may indicate credential theft

How to Mitigate CVE-2026-1246

Immediate Actions Required

• Update the ShortPixel Image Optimizer plugin to a patched version beyond 6.4.2
• Audit all WordPress user accounts with Editor-level access and above for unauthorized activity
• Review web server access logs for potential exploitation attempts
• Consider temporarily disabling the plugin until the update can be applied

Patch Information

A security patch addressing this vulnerability is available. Site administrators should update the ShortPixel Image Optimizer plugin to the latest available version through the WordPress plugin repository. The WordPress Plugin Changeset documents the changes made to remediate this vulnerability.

Workarounds

• Restrict Editor-level access to only trusted users until the plugin can be updated
• Implement web application firewall rules to block path traversal sequences in AJAX requests
• Consider temporarily deactivating the ShortPixel Image Optimizer plugin if immediate patching is not feasible
• Apply server-level restrictions to limit file read access for the web server process

# Example .htaccess rule to block path traversal attempts
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{QUERY_STRING} loadFile=.*\.\. [NC]
    RewriteRule .* - [F,L]
</IfModule>