CVE-2026-91051: EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EWWW Image Optimizerto a version that resolves this vulnerability.Fixed in 8.8.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with author-level permissions can exploit it. The vulnerable plugin versions are before 8.8.0, including 8.6.0 through 8.7.7.
What must be present for exploitation to result in remote code execution?
The attacker must be able to store a serialized value in the eio_page_settings post meta field, and a suitable PHP gadget chain must be available. The available data indicates such a gadget chain may come from another installed vulnerable EWWW Image Optimizer WordPress plugin.
What should be updated?
Update EWWW Image Optimizer to version 8.8.0 or later. This version boundary is identified as fixing the issue.