CVE-2026-1246 is a path traversal vulnerability (CWE-22) in the ShortPixel Image Optimizer plugin for WordPress. The issue arises from insufficient validation and sanitization of the 'loadFile' parameter in the 'loadLogFile' AJAX action, enabling authenticated users with Editor or higher privileges to perform arbitrary file reads on the server. This can lead to exposure of sensitive data stored in files accessible by the web server process. The vulnerability affects all versions up to and including 6.4.2. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high privileges required.

An attacker with Editor-level or higher access to the WordPress site can exploit this vulnerability to read arbitrary files on the server. This may result in disclosure of sensitive information such as database credentials and authentication keys, potentially facilitating further attacks or unauthorized access. There is no indication of impact to integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and monitor for suspicious activity related to the 'loadLogFile' AJAX action. Avoid exposing sensitive files on the server where possible.