CVE-2026-17086: ShortPixel Image Optimizer PHP Object Injection

CVE-2026-17086 Overview

CVE-2026-17086 is a PHP Object Injection vulnerability in the ShortPixel Image Optimizer plugin for WordPress. The flaw affects all versions up to and including 6.5.5 and stems from unsafe deserialization of untrusted input [CWE-502]. Authenticated attackers with author-level access or higher can inject a PHP object into the application. The plugin itself contains no known Property-Oriented Programming (POP) chain, so exploitation requires an additional plugin or theme with a usable POP chain. When such a chain exists, the resulting object injection can lead to arbitrary file deletion, sensitive data disclosure, or remote code execution.

Critical Impact

Authenticated author-level attackers can inject arbitrary PHP objects, enabling file deletion, data theft, or code execution when a POP chain is present in any installed plugin or theme.

Affected Products

• ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress
• All versions up to and including 6.5.5
• WordPress sites where any installed plugin or theme contains a POP chain

Discovery Timeline

• 2026-09-18 - CVE-2026-17086 published to the National Vulnerability Database
• 2026-09-18 - Last updated in the NVD database

Technical Details for CVE-2026-17086

Vulnerability Analysis

The ShortPixel Image Optimizer plugin passes attacker-controllable input to a PHP deserialization function. The vulnerable code paths reside in the Replacer.php file within the bundled replacer2 component and in the OptimizeAiController.php controller. Referenced lines include Replacer.php lines 259, 402, 425, 429, and 446, plus OptimizeAiController.php line 598.

When PHP encounters serialized data through functions such as unserialize(), it reconstructs objects and invokes magic methods including __wakeup(), __destruct(), and __toString(). An attacker who controls the serialized payload can trigger chained method calls on classes already loaded in the WordPress runtime. This mechanism is known as a Property-Oriented Programming chain.

Root Cause

The root cause is deserialization of untrusted input without validation or use of safe formats such as JSON. The plugin trusts data that an authenticated user can influence and passes it to PHP's native serialization handler. This violates secure coding practices for handling serialized data as defined under [CWE-502].

Attack Vector

Exploitation requires authenticated access at the author role or higher. The attacker submits a crafted serialized PHP payload through a request handled by the vulnerable code paths in Replacer.php or OptimizeAiController.php. If a POP chain exists in another installed plugin, theme, or in WordPress core-adjacent libraries, deserialization triggers the chain. Outcomes depend on the gadget chain but typically include arbitrary file deletion, information disclosure, or PHP code execution. Refer to the Wordfence Vulnerability Intel entry for additional technical context.

Detection Methods for CVE-2026-17086

Indicators of Compromise

• HTTP POST requests to ShortPixel plugin endpoints containing serialized PHP markers such as O:, a:, or s: followed by class or property names.
• Unexpected file deletions, new PHP files in wp-content/uploads/, or modified plugin and theme files following author-level authenticated activity.
• WordPress audit log entries showing author-role accounts interacting with ShortPixel optimization or replacer functionality outside normal workflows.

Detection Strategies

• Inspect web server access logs for requests to ShortPixel plugin actions carrying serialized object payloads in POST bodies or query parameters.
• Deploy web application firewall rules that flag serialized PHP object patterns submitted by authenticated non-admin users.
• Correlate author-role login events with subsequent filesystem changes, outbound network callbacks, or new scheduled tasks in WordPress.

Monitoring Recommendations

• Enable WordPress activity logging for role changes, plugin activations, and file modifications performed by author-level accounts.
• Monitor PHP error logs for unserialize() warnings, unexpected class instantiations, or __wakeup() and __destruct() invocations from ShortPixel code paths.
• Alert on any process spawned by the PHP-FPM or web server user that executes shell commands, downloads remote files, or writes to plugin directories.

How to Mitigate CVE-2026-17086

Immediate Actions Required

• Update the ShortPixel Image Optimizer plugin to a version later than 6.5.5 as soon as the vendor publishes a patched release.
• Audit WordPress user accounts and remove or downgrade unnecessary author-level or higher privileges.
• Review all installed plugins and themes and remove unused or unmaintained components that could supply a POP chain.

Patch Information

The vulnerability is present through version 6.5.5. Track the ShortPixel changeset overview on WordPress.org for the fixed release, and consult the Wordfence Vulnerability Intel entry for confirmation of the patched version.

Workarounds

• Restrict the author role and higher to trusted users only, and enforce multi-factor authentication on all such accounts.
• Deploy a web application firewall rule that blocks serialized PHP object payloads containing patterns such as O: followed by a digit and class name in requests to ShortPixel endpoints.
• Temporarily deactivate the ShortPixel Image Optimizer plugin on sites that cannot immediately update or restrict author-level access.

# Example WAF rule pattern (ModSecurity-style) to block serialized PHP objects
SecRule ARGS "@rx O:[0-9]+:\"[a-zA-Z_\\\\]+\":[0-9]+:" \
  "id:1017086,phase:2,deny,status:403,\
  msg:'CVE-2026-17086 - Serialized PHP object detected in request'"