ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF Security & Risk Analysis

The "shortpixel-image-optimiser" v6.4.3 plugin exhibits a mixed security posture. On the positive side, it demonstrates strong practices in SQL query handling, exclusively using prepared statements, and a good proportion of its output is properly escaped. The absence of dangerous functions and bundled libraries is also reassuring. However, a significant concern arises from its attack surface, with 5 out of 6 AJAX handlers lacking authentication checks. This creates a considerable risk of unauthorized actions being performed through these endpoints. The taint analysis, while not revealing critical or high severity issues, did identify flows with unsanitized paths, which warrants attention. The plugin's vulnerability history, with 6 known medium severity CVEs across various common types like Path Traversal and Missing Authorization, suggests a recurring pattern of security weaknesses that have been addressed in past versions. While there are no currently unpatched vulnerabilities, this history indicates potential for similar issues to arise if not carefully managed. The fact that the last vulnerability was in the future (2026-02-04) is likely a data anomaly and should be disregarded in the assessment.