CVE-2026-91072: EWWW Image Optimizer Privilege Escalation

CVE-2026-91072 Overview

CVE-2026-91072 affects the EWWW Image Optimizer WordPress plugin in versions prior to 8.8.0. The plugin's WebP-derivative file migration routine fails to constrain file operations to the current site's uploads directory. An authenticated attacker with Administrator-level access can rename or delete WebP-derivative image files located outside the intended scope. On WordPress multisite deployments, this allows tampering with WebP files belonging to other sites the attacker does not administer, breaking tenant isolation across the network.

Critical Impact
Administrator users on one multisite subsite can rename or delete WebP-derivative image files on other subsites, violating multisite tenant boundaries and enabling targeted content destruction.

Affected Products

EWWW Image Optimizer WordPress plugin, all versions before 8.8.0
WordPress single-site installations using the plugin (limited scope)
WordPress multisite networks using the plugin (cross-site impact)

Discovery Timeline

2026-09-30 - CVE-2026-91072 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-91072

Vulnerability Analysis

The flaw resides in a plugin routine that migrates WebP-derivative image files. WebP derivatives are the .webp companion files the plugin generates alongside JPEG or PNG originals in the WordPress uploads directory. The migration routine accepts or constructs file paths without enforcing that the target file resides within the current site's uploads directory. As a result, path arguments can point to files anywhere the WordPress process can read and write.

On a standard WordPress multisite network, each subsite maintains its own uploads subdirectory under wp-content/uploads/sites/<id>/. Administrators on one subsite are not granted authority over other subsites. The missing scope check breaks that boundary. An Administrator on subsite A can rename or delete WebP derivatives inside the uploads tree of subsite B. This maps to Path Traversal [CWE-22] and Improper Access Control [CWE-284].

Root Cause

The migration function does not validate that the resolved file path is a descendant of the current site's uploads directory. There is no canonicalization check comparing the target path against wp_upload_dir() for the active site context. File operations proceed on any WebP-derivative path the caller supplies or that the routine enumerates.

Attack Vector

Exploitation requires an authenticated session with Administrator-level privileges on at least one site. The attacker triggers the WebP migration routine through the plugin's administrative interface. Because the routine operates on paths outside the current site scope, files belonging to unrelated sites or filesystem locations reachable by the web server user can be renamed or deleted. The impact is limited to WebP-derivative files but can disrupt media rendering, break site layouts, and destroy backup-less assets across a multisite tenant. Refer to the WPScan Vulnerability Details for additional technical context.

Detection Methods for CVE-2026-91072

Indicators of Compromise

Unexpected disappearance or renaming of .webp files under wp-content/uploads/sites/<id>/ on multisite installations.
WordPress media library entries showing broken WebP variants while original JPEG or PNG files remain intact.
Plugin activity logs referencing WebP migration executed by an Administrator whose scope does not include the affected site.

Detection Strategies

Audit installed plugin versions across WordPress inventory and flag any EWWW Image Optimizer install below 8.8.0.
Correlate WordPress admin action logs with filesystem change events on the uploads directory to identify cross-site file operations.
On multisite networks, monitor for file writes or deletes where the acting subsite context differs from the target path's site directory.

Monitoring Recommendations

Enable filesystem auditing (for example, auditd on Linux) on wp-content/uploads/ and alert on rename or delete operations affecting .webp files.
Ship WordPress admin activity logs and web server access logs to a centralized SIEM for cross-referencing plugin actions against file changes.
Track privileged user sessions on multisite super-admin and per-site administrator accounts and alert on off-hours plugin management activity.

How to Mitigate CVE-2026-91072

Immediate Actions Required

Upgrade EWWW Image Optimizer to version 8.8.0 or later on every WordPress installation, prioritizing multisite networks.
Review Administrator accounts on multisite subsites and remove accounts that do not require ongoing privileged access.
Back up the wp-content/uploads/ directory and database before applying the patch to enable recovery of any tampered WebP derivatives.

Patch Information

The vendor addressed the issue in EWWW Image Optimizer 8.8.0. Update the plugin through the WordPress admin interface, WP-CLI (wp plugin update ewww-image-optimizer), or by deploying the fixed package from the WordPress plugin repository. Consult the WPScan Vulnerability Details for advisory metadata.

Workarounds

Deactivate the EWWW Image Optimizer plugin on multisite networks until the update is applied.
Restrict Administrator role assignments on multisite subsites to trusted personnel only and require multi-factor authentication for privileged logins.
Apply filesystem permissions that scope the web server user's write access as narrowly as operationally feasible within the uploads tree.

bash

# Update the plugin using WP-CLI
wp plugin update ewww-image-optimizer --version=8.8.0

# Verify installed version across a multisite network
wp plugin get ewww-image-optimizer --field=version