This vulnerability (CVE-2026-39471) in ShortPixel Image Optimizer (<=6.4.3) is caused by unsafe deserialization of untrusted data, specifically PHP Object Injection. The flaw allows an attacker with high privileges to execute arbitrary code or manipulate application behavior, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on all security properties. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. Because the attack requires high privileges, it is likely limited to authenticated users with elevated rights. The vulnerability can be exploited remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users with appropriate privileges and monitor for suspicious activity related to deserialization processes.