ShortPixel Image Optimizer versions up to 6.4.2 allow an authenticated attacker with Editor role or higher to read any file on the web server. The vulnerability arises from path‑traversal in an AJAX endpoint that receives a ‘loadFile’ parameter without proper validation or sanitization. An attacker can request sensitive files such as wp-config.php or .env, exposing database credentials, API keys and other secrets. The weakness is classified as CWE‑22, a path traversal flaw that compromises confidentiality of arbitrary server files.

WordPress sites running the ShortPixel Image Optimizer plugin of any version from the initial release through 6.4.2. The affected product is the ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin provided by ShortPixel.

The CVSS base score of 4.9 indicates moderate severity; however, the exploitability is low as reflected by an EPSS score under 1%. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack vector relies on the user already having Editor‑level WordPress access; an attacker must authenticate and then send a crafted AJAX request targeting the vulnerable ‘loadLogFile’ action. Because of the path‑traversal logic, any file path can be resolved, allowing direct read of the server’s file system within the webroot.