The ShortPixel Adaptive Images plugin contains a Missing Authorization flaw (CWE‑862) that allows attackers to exploit incorrectly configured access control security levels. This missing authorization vulnerability enables users to perform privileged actions on the plugin without proper authentication. The flaw does not provide direct remote code execution or data exfiltration capabilities.

WordPress sites that use the ShortPixel Adaptive Images plugin are affected. The issue applies to all releases from the initial build through version 3.10., inclusive. Any instance of the plugin at 3.10.0 or earlier is vulnerable.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker would target exposed plugin endpoints or administrative interfaces that lack proper authorization checks; success requires no pre‑existing credentials, as the missing authorization allows unauthorized requests to perform configuration changes. The potential impact is limited to unauthorized plugin configuration modifications rather than full system compromise.