The ShortPixel Image Optimizer plugin for WordPress contains a missing capability check on the 'shortpixel_ajaxRequest' AJAX action, which allows an authenticated user with Contributor-level or higher permissions to export and import site options. This capability bypass enables the attacker to modify the plugin’s configuration data, potentially changing image optimization settings.

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF, all versions up to and including 6.3.4. The flaw can affect any WordPress site that has the plugin installed and employs user roles with Contributor or higher privileges.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of <1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only authenticated access with Contributor or higher roles; the exploitation path involves sending a crafted AJAX request to the plugin’s endpoint. The missing capability check allows the attacker to change configuration via the export/import functions.