CVE-2026-91051

— UNSCORED

Published 2026-09-30 · Updated 2026-09-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

All references

https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725455d55/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.