CVE-2026-15345 is an authorization bypass vulnerability (CWE-862) in the ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization WordPress plugin affecting all versions up to 3.11.5. The plugin fails to properly verify user authorization for certain actions, enabling authenticated attackers with subscriber-level privileges or above to modify configuration settings of third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. The impact on third-party plugins' settings is contingent on those plugins being installed. There is no vendor advisory or patch information currently available.

An attacker with subscriber-level access or higher can bypass authorization controls to alter configuration options of multiple third-party plugins and the ShortPixel plugin's API key and account binding. This could lead to unauthorized changes in plugin behavior or integration settings. However, the vulnerability does not impact confidentiality or availability directly, and exploitation requires the attacker to have at least subscriber-level authenticated access and the presence of specific third-party plugins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user privileges where possible and monitor for suspicious configuration changes. No official patch or temporary fix is currently documented.