{"id":"CVE-2025-11378","aliases":["EUVD-2025-34954","GHSA-44j2-7x4f-pq34"],"status":"published","title":"ShortPixel Image Optimizer \u003c= 6.3.4 - Authenticated (Contributor+) Settings Import/Export","description":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00319,"percentile":0.25147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2025-10-18T03:33:23Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"shortpixel","product":"shortpixel image optimizer – optimize images, convert webp \u0026 avif"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7e9eb5-e222-43fa-a14f-b9cbced6b8f5?source=cve","tags":["web"]},{"url":"https://research.cleantalk.org/CVE-2025-11378","tags":["web"]},{"url":"https://github.com/short-pixel-optimizer/shortpixel-image-optimiser/commit/74263060acafbaf63b4a34f339a8b0dc35f2cad9","tags":["fix"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3379473%40shortpixel-image-optimiser\u0026new=3379473%40shortpixel-image-optimiser\u0026sfp_email=\u0026sfph_mail=","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11378","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-44j2-7x4f-pq34"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11378.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-11378","title":"ShortPixel Image Optimizer \u003c= 6.3.4 - Authenticated (Contributor+) Settings Import/Export","description":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.","status":"published","published":"2025-10-18T03:33:23.231Z","modified":"2026-04-08T16:41:01.563Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-34954","description":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.","status":"published","published":"2025-10-18T03:33:23Z","modified":"2026-04-08T16:41:01Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:06.888768Z"}],"ghsa":[{"id":"GHSA-44j2-7x4f-pq34","title":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is...","description":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.","status":"published","published":"2025-10-18T06:30:25Z","modified":"2025-10-18T06:30:31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:04:01.823376Z"}],"nvd":[{"id":"CVE-2025-11378","description":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.","status":"published","published":"2025-10-18T04:16:05.933Z","modified":"2026-10-09T10:10:00.193Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-11378","title":"ShortPixel Image Optimizer \u003c= 6.3.4 - Authenticated (Contributor+) Settings Import/Export","description":"The ShortPixel Image Optimizer – Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.","status":"published","published":"2025-10-18T03:33:23.231Z","modified":"2026-10-28T02:30:58.834313675Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:46.024537Z"}]}}