CVE-2026-1246: 
WordPress vulnerability analysis and mitigation

CVE-2026-1246 is an Arbitrary File Read vulnerability in the ShortPixel Image Optimizer plugin for WordPress, exploitable via path traversal in the loadFile parameter of the loadLogFile AJAX action. It affects all versions of the plugin up to and including 6.4.2, due to insufficient path validation and sanitization. The vulnerability was published on February 5, 2026, and was discovered and reported by Wordfence. It carries a CVSS v3.1 base score of 4.9 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable code resides in the loadLogFile AJAX action handler within AjaxController.php, where the loadFile parameter is not adequately validated or sanitized before being used in a file read operation, allowing an attacker to traverse outside the intended directory. Exploitation requires an authenticated session with at least Editor-level WordPress privileges, and is performed over the network via a crafted AJAX request. Relevant source code is publicly visible in the plugin's SVN repository (Wordfence, WordPress SVN).

Successful exploitation allows an authenticated attacker with Editor-level access or above to read arbitrary files from the server's filesystem, including sensitive files such as WordPress configuration files (wp-config.php) containing database credentials, authentication keys, and salts. This is a confidentiality-only impact — integrity and availability are not directly affected. Exposure of database credentials could enable further attacks such as database compromise or lateral movement within the hosting environment (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.129%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to authenticated users with Editor-level access or higher, which significantly reduces the attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running ShortPixel Image Optimizer version 6.4.2 or earlier. This can be done by checking the plugin's readme.txt or stable tag via the WordPress plugin directory path (e.g., /wp-content/plugins/shortpixel-image-optimiser/readme.txt).
2. Obtain Editor-level credentials: Gain authenticated access to the WordPress site with at least Editor-level privileges (e.g., through credential theft, phishing, or brute force).
3. Craft malicious AJAX request: Send an authenticated POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the loadLogFile action, with the loadFile parameter set to a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd).
4. Read arbitrary files: The server processes the unsanitized loadFile parameter and returns the contents of the targeted file in the response, exposing sensitive data such as database credentials or authentication keys (Wordfence, WordPress SVN).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=loadLogFile and a loadFile parameter containing path traversal sequences (e.g., ../, %2e%2e%2f, or absolute paths like /etc/passwd or wp-config.php).
• Logs: WordPress or web server access logs showing repeated AJAX requests to admin-ajax.php with encoded or raw path traversal strings in POST body parameters from Editor-level user accounts.
• File System: No direct file system artifacts are expected, as this is a read-only vulnerability; however, monitor for unexpected access to sensitive files like wp-config.php in server-side file access logs if available.

Users should update the ShortPixel Image Optimizer plugin to version 6.4.3 or later, which addresses the insufficient path validation in the loadLogFile AJAX action. The patch is available via the WordPress plugin repository changeset. As a temporary workaround, site administrators can restrict Editor-level user accounts to trusted individuals only, or temporarily deactivate the plugin until patching is feasible (Wordfence, WordPress SVN Changeset).

Sucuri included this vulnerability in their February 2026 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). The vulnerability was also covered by InfinitSec in a dedicated technical post (InfinitSec). No significant social media controversy or major vendor statements beyond the Wordfence advisory have been observed.