CVE-2024-48043
📛 CVE Title
WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- HIGH
- CVSS score
- 7.6 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L- Effective score
- 7.6 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-89 - Reserved
- 2024-10-08
- Published
- 2024-10-17 14:08 UTC
- Last updated
- 2026-05-13 00:55 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/48xxx/CVE-2024-48043.json
- Linked Threat
- CVE-2024-48043 — ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2024-10-17 12:15:02 UTC
- NVD last modified
- 2026-06-17 07:58:09 UTC
- NVD CVSS v3.1
- 7.6 / 10 HIGH source: audit@patchstack.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L- Exploitability subscore
- 2.3 / 10
- Impact subscore
- 4.7 / 10
- EPSS score
- 0.0045 (probability of exploitation in next 30 days)
- EPSS percentile
- 36.82% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27
NVD / KEV / EPSS data refreshed 2026-07-27 23:53 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-42915 - Assigner
- Patchstack
- Published
- Oct 17, 2024, 12:08:41 PM
- Updated
- May 12, 2026, 10:55:23 PM
- EUVD base score (CVSS 3.1)
-
7.6 / 10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - EUVD-reported EPSS
- 0.4600
- Vendors
- shortpixel
- Products
-
ShortPixel Image Optimizer (n/a ≤5.6.3)ShortPixel Image Optimizer (0 ≤5.6.3)
- Aliases
-
GHSA-g487-gqfx-jgg8
ENISA description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| ShortPixel | ShortPixel Image Optimizer |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://cwe.mitre.org/data/definitions/89.html rapid7:cwe.mitre.org
- https://attackerkb.com/topics/CVE-2024-48043 rapid7:attackerkb.com
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-42915 rapid7:euvd.enisa.europa.eu
- https://www.cve.org/CVERecord?id=CVE-2024-48043 rapid7:www.cve.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3607420e-3f02-425d-a708-f785ce66f2db?source=api-prod rapid7:www.wordfence.com
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Indicators (2)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| domain |
injection.this
|
no local data | 2026-05-18 21:19 UTC |
| cve |
CVE-2024-48043
|
no local data | 2026-06-06 14:19 UTC |
Remediations (28)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:msrc.microsoft.com
Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.
2026-08-02 12:03 UTC -
web:www.veeam.com
When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.
2026-08-02 12:03 UTC -
web:cybersecuritynews.com
Microsoft has released its June 2026 Patch Tuesday security updates, addressing a hefty 198 vulnerabilities across its product ecosystem. The June rollout, published on June 9, 2026, stands out not only for its volume but also for the inclusion of three zero-day vulnerabilities that were actively exploited or publicly known before a fix was available. Administrators are urged to prioritize ...
2026-08-02 12:03 UTC -
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-08-02 12:03 UTC -
web:www.microsoft.com
Help protect your computing environment by keeping up to date on Microsoft technical security notifications. Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of ...
2026-08-02 12:03 UTC -
web:www.microsoft.com
These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.
2026-08-02 12:03 UTC -
web:techcommunity.microsoft.com
Hi team, Our organization has successfully implemented the recommended mitigation for CVE -2026-42897. However, we are currently experiencing the documented known issues within our environment. Could the Exchange team kindly provide a tentative timeline or ETA for a permanent security update that resolves the underlying vulnerability while addressing these known issues? We would greatly ...
2026-08-02 12:03 UTC -
Wordfence remediation: ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIFWordfence
Update to version 5.6.4, or a newer patched version
2026-06-06 14:19 UTC -
web:robertsspaceindustries.com
Hi Everyone! Time again for another Hotfix Central thread to keep you all up to date on things going on outside of the normal patch cycle in SC Alpha 4.8 LIVE! This will be a living document of...
2026-05-22 10:25 UTC -
web:gemini.google.com
Meet Gemini, Google's AI assistant. Get help with writing, planning, brainstorming, and more. Experience the power of generative AI.
2026-05-22 10:25 UTC -
web:cybersecuritynews.com
No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.
2026-05-22 10:25 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 10:25 UTC -
web:www.addictivetips.com
Microsoft regularly releases updates for Windows that your computer needs in order to take advantage of the latest security patches and hotfixes. On most PCs, the Windows Update service is scheduled to run automatically, prompting you about pending updates that require your attention. Unfortunately, the updating service doesn't always work as expected, throwing errors such as 0x8024401c as a ...
2026-05-22 10:25 UTC -
web:nvd.nist.gov
Official websites use .gov A .gov website belongs to an official government organization in the United States.
2026-05-22 10:25 UTC -
web:www.thewindowsclub.com
You can troubleshoot and fix Windows Update error 0x80244022 by following the suggestions in this post. Reset Windows Update Components, and more!
2026-05-22 10:25 UTC -
web:www.tomshardware.com
Microsoft released security update KB5034441 on Patch Tuesday to fix a BitLocker encryption bypass vulnerability affecting Windows 10 users. However, some users are experiencing an update failure ...
2026-05-22 10:25 UTC -
web:cyberpress.org
A newly published proof-of-concept tool called BitUnlocker exposes a dangerous downgrade attack that can bypass Microsoft's BitLocker full-disk encryption on fully patched Windows 11 machines, granting complete access to encrypted drives in under five minutes. The attack exploits CVE -2025-48804, a vulnerability in Windows BitLocker that allows an attacker to mix untrusted data with trusted ...
2026-05-22 10:25 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 10:25 UTC -
web:bash.com
Bash is a fashion and lifestyle shopping platform in South Africa offering over 200 of the world's best brands and 2000+ new items added weekly.
2026-05-22 03:26 UTC -
web:patch.moe
Age Verification Are you 18 years or older? YES NO
2026-05-22 03:26 UTC -
web:patchnashville.com
Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories. My hope is that you always find what you came for and feel as inspired by our collections as we are.
2026-05-22 03:26 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 03:26 UTC -
web:www.fixferreterias.com
FIX FERRETERÍAS Acerca de nosotros Ubica tu tienda Catálogo Grupo Truper SOPORTE AL CLIENTE Facturación Cotizaciones Preguntas Frecuentes Mis pedidos POLÍTICAS Ventas Devoluciones Garantías Precios Aviso de privacidad
2026-05-22 03:26 UTC -
web:feedly.com
CVE Id: CVE-2024-48043 Release Date: 2025-02-04 Update Date: 2025-02-04 Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through 5.6.3. Statement Red Hat Product Security has determined that this vulnerability ...
2026-05-22 03:26 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-05-22 03:26 UTC -
web:www.oracle.com
Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...
2026-05-22 03:26 UTC -
web:www.romhacking.net
Add temporary header() Patch file: Apply patch Original ROM: Modified ROM: Patch type: IPS BPS PPF UPS APS RUP Create patch Settings Rom Patcher JS v2.9 by Marc Robledo See on GitHub Donate Language English Français Deutsch Italiano Español Nederlands Svenska Català Valencià Português Brasileiro Russian 日本語 中文（简体） 中文 ...
2026-05-22 03:26 UTC -
web:msrc.microsoft.com
Vulnerabilities CVE -2026-45498
2026-05-22 03:26 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-48043.json.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:shortpixel:shortpixel_image_optimizer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "shortpixel_image_optimizer",
"vendor": "shortpixel",
"versions": [
{
"lessThanOrEqual": "5.6.3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.6.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-48043",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-17T14:09:11.585697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T22:55:23.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "shortpixel-image-optimiser",
"product": "ShortPixel Image Optimizer",
"vendor": "ShortPixel",
"versions": [
{
"changes": [
{
"at": "5.6.4",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.6.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rafie Muhammad | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:28:04.639Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.<p>This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.</p>"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:10:22.380Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/shortpixel-image-optimiser/vulnerability/wordpress-shortpixel-image-optimizer-plugin-5-6-3-sql-injection-vulnerability?_s_id=cve"
}
],
"title": "WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2024-48043",
"datePublished": "2024-10-17T12:08:41.608Z",
"dateReserved": "2024-10-08T13:14:57.117Z",
"dateUpdated": "2026-05-12T22:55:23.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}