CVE-2026-91051

Published: Set 30, 2026 Last Modified: Set 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-19…
https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725455d55/