CVE-2026-17086 is a PHP Object Injection vulnerability in the ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF WordPress plugin affecting all versions up to and including 6.5.5. The flaw arises from unsafe deserialization of untrusted input, allowing authenticated users with author-level privileges or higher to inject PHP objects. However, no gadget (POP) chain is present in the plugin itself, so exploitation requires an additional plugin or theme containing a POP chain. Successful exploitation could lead to arbitrary file deletion, data disclosure, or code execution depending on the POP chain available on the target system.

The vulnerability allows authenticated attackers with author-level access or higher to inject PHP objects via deserialization. Without a POP chain in other installed plugins or themes, there is no direct impact. If a POP chain is present, attackers may delete arbitrary files, retrieve sensitive information, or execute arbitrary code, leading to high confidentiality, integrity, and availability impacts.

No official patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and audit installed plugins and themes for known POP chains that could be leveraged. Monitor vendor channels for updates and apply patches promptly when released.