The ShortPixel Adaptive Images plugin version 3.11.4 and earlier contain a vulnerability that allows an unauthenticated attacker to delete arbitrary files on the WordPress server. This flaw stems from insufficient validation of file paths before deletion and effectively permits the removal of any file accessible to the web server, compromising file integrity and potentially disrupting site functionality or data availability.

All installations of the ShortPixel Adaptive Images plugin running version 3.11.4 or earlier are affected. The vendor has released version 3.11.5 which fixes the issue.

The CVSS score of 5.8 places the vulnerability in the moderate severity range. Because the vulnerability is unauthenticated, an attacker only needs to send a crafted HTTP request to trigger file deletion; no special privileges are required. The EPSS score is not reported, providing no precise measure of exploitation likelihood, and the issue is not listed in CISA's KEV catalog. Nonetheless, the ability to delete arbitrary files is a serious risk, especially on production sites where critical files may be removed, leading to downtime or data loss.