Unrated severityNVD Advisory· Published Sep 30, 2026

CVE-2026-91051

Description

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Ewww Image Optimizerllm-fuzzy
Range: <8.8.0
Package: https://wordpress.org/plugins/ewww-image-optimizer

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725455d55/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000