The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data in the ShortPixel Image Optimizer WordPress plugin, affecting versions up to 6.5.5. An attacker who can supply crafted serialized input to the plugin can trigger the creation of arbitrary PHP objects, potentially leading to code execution or other malicious outcomes. This weakness is identified as CWE‑502.

ShortPixel Image Optimizer plugin for WordPress, versions up to and including 6.5.5. Any WordPress installation that has this plugin installed and has not applied the 6.5.6 update is at risk.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is < 1% (approximately 0.00214), indicating a very low yet non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that large‑scale exploitation has not yet been observed. The likely attack vector is via the plugin’s API or configuration interface, which requires an authenticated user with subscriber‑level access to the plugin. If an attacker can supply crafted serialized data through the plugin, arbitrary objects can be instantiated, leading to remote code execution. Verification of a current patch is required before accepting this vulnerability as mitigated.