CVE-2026-91051: EWWW Image Optimizer WordPress RCE Flaw

CVE-2026-91051 Overview

CVE-2026-91051 affects the EWWW Image Optimizer WordPress plugin in versions before 8.8.0. The plugin fails to prevent authenticated users with author-level permissions from storing a serialized value in a post meta field. When the post is later rendered, the value is deserialized, enabling PHP Object Injection. If a suitable gadget chain exists in another installed plugin or theme, an attacker can achieve remote code execution on the WordPress server.

Critical Impact

Authenticated author-level users can trigger PHP Object Injection through post meta deserialization, potentially leading to remote code execution when a gadget chain is available.

Affected Products

• EWWW Image Optimizer WordPress plugin versions prior to 8.8.0
• WordPress sites permitting author-level accounts to publish or edit posts
• WordPress environments where additional plugins or themes expose deserialization gadget chains

Discovery Timeline

• 2026-09-30 - CVE-2026-91051 published to the National Vulnerability Database (NVD)
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-91051

Vulnerability Analysis

The vulnerability is an Insecure Deserialization flaw [CWE-502] leading to PHP Object Injection. The EWWW Image Optimizer plugin accepts user-controlled input from authenticated accounts and stores it as serialized data inside a WordPress post meta field. When the affected post is rendered, the plugin retrieves and deserializes that value using PHP's unserialize() mechanism without validating the object types being reconstructed.

PHP Object Injection becomes exploitable when the runtime contains classes with magic methods such as __wakeup(), __destruct(), or __toString() that perform sensitive operations. A gadget chain assembled from another installed WordPress plugin or theme can escalate the injection into arbitrary code execution, file writes, or database manipulation.

Root Cause

The root cause is the plugin's trust in author-supplied post meta data. Author-level accounts should not be able to influence serialized structures consumed by server-side deserialization routines. The absence of input validation and the use of unsafe deserialization on rendering combine to expose the object injection surface.

Attack Vector

An attacker requires an authenticated WordPress account with at least author privileges. The attacker crafts a post containing a serialized PHP object payload, stored through the vulnerable post meta field. When the post is rendered — for example, when a viewer loads the published page — the plugin deserializes the payload and instantiates attacker-controlled objects, invoking any gadget chain present in the environment.

Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-91051

Indicators of Compromise

• Post meta entries containing PHP serialized data patterns such as O: (object), a: (array), or s: (string) written by author-level accounts
• Unexpected PHP processes spawned by the web server user (www-data, apache, nginx) after post publication or page rendering
• New or modified PHP files in the WordPress wp-content/uploads/ or plugin directories that do not correspond to legitimate updates
• Outbound connections initiated by the WordPress PHP process to unfamiliar hosts following post views

Detection Strategies

• Audit the wp_postmeta table for meta keys owned by the EWWW Image Optimizer plugin that contain serialized PHP object markers (O: prefix)
• Review WordPress user role assignments and identify author-level accounts created or elevated in the affected window
• Monitor web server access logs for POST requests to post.php or the REST API originating from author accounts, followed by GET requests that trigger deserialization
• Enable PHP error logging to capture __wakeup or __destruct failures indicative of failed injection attempts

Monitoring Recommendations

• Alert on file integrity changes across wp-content/plugins/ and wp-content/themes/ directories
• Track process execution telemetry from the web server user for shell interpreters (sh, bash, python) and outbound network syscalls
• Correlate WordPress edit_post and update_post_meta events with subsequent anomalous PHP activity

How to Mitigate CVE-2026-91051

Immediate Actions Required

• Upgrade the EWWW Image Optimizer plugin to version 8.8.0 or later on every WordPress installation
• Audit all author-level and higher accounts, removing accounts that are inactive or unnecessary
• Rotate credentials for author-level accounts if unauthorized activity is suspected
• Review installed plugins and themes for known deserialization gadget chains and update or remove vulnerable components

Patch Information

The vendor addressed the vulnerability in EWWW Image Optimizer version 8.8.0. Site administrators should apply the update through the WordPress plugin dashboard or by deploying the updated package via their configuration management system. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

• Restrict post editing capabilities so that only trusted editor or administrator accounts can create or modify posts until the patch is applied
• Deactivate the EWWW Image Optimizer plugin in environments where an immediate update is not feasible
• Deploy a web application firewall (WAF) rule that blocks serialized PHP object patterns in post meta form fields
• Disable public rendering of posts authored by lower-privilege accounts until sites are patched

# Configuration example: WP-CLI commands to update the plugin and audit author accounts
wp plugin update ewww-image-optimizer --version=8.8.0
wp user list --role=author --fields=ID,user_login,user_registered,user_email
wp post meta list <post_id> --format=json | grep -E 'O:[0-9]+:'