{"id":"CVE-2026-91051","aliases":["EUVD-2026-89618","GHSA-rhvr-pxgv-9rpq"],"status":"published","title":"EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta","description":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0034,"percentile":0.27884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-09-30T06:00:24Z","modified":"2026-09-30T16:28:31Z","products":[{"vendor":"exactly www","product":"ewww image optimizer"},{"vendor":"unknown","product":"ewww image optimizer"}],"references":[{"url":"https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725455d55/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91051"},{"url":"https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725455d55"},{"url":"https://github.com/advisories/GHSA-rhvr-pxgv-9rpq"}],"sources":{"cve":[{"id":"CVE-2026-91051","title":"EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta","description":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .","status":"published","published":"2026-09-30T06:00:24.54Z","modified":"2026-09-30T13:37:22.16Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-89618","description":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .","status":"published","published":"2026-09-30T06:00:24Z","modified":"2026-09-30T13:37:22Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:49.833828Z"}],"ghsa":[{"id":"GHSA-rhvr-pxgv-9rpq","title":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with...","description":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .","status":"published","published":"2026-09-30T06:31:36Z","modified":"2026-09-30T15:32:26Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:12:36.997507Z"}],"nvd":[{"id":"CVE-2026-91051","description":"The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .","status":"published","published":"2026-09-30T06:17:09.173Z","modified":"2026-09-30T16:28:31.51Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:52.759595Z"}]}}