EWWW Image Optimizer <= 8.7.7 - Authenticated (Administrator+) Limited File Deletion and Renaming via WebP Migration on Multisite
- ID
- WPSEC-2026-0242
- Plugin
- EWWW Image Optimizer (ewww-image-optimizer)
- Affected
- all versions before 8.8.0
- Remediation
- Update to 8.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
- Weakness
- CWE-22
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- EWWW Image Optimizer on WPSec AttackSurface
- Fix released
- Published
Description
The EWWW Image Optimizer plugin for WordPress is vulnerable to limited file deletion and renaming in all versions up to, and including, 8.7.7. The WebP migration AJAX handler acts on file paths supplied in the 'webp_images' parameter without checking that they lie within the current site's upload directory. This makes it possible for authenticated attackers with administrator-level access on a sub-site of a multisite network, who are not super administrators, to rename files, or delete them when a matching original image and WebP copy already exist alongside, in other sites' upload folders or elsewhere under wp-content. Sub-site administrators can only reach the handler when the network lets them manage plugins (the 'activate_plugins' capability, granted by enabling the Plugins menu for site administrators). Single-site installations are not affected.
References
- https://wpsec.com/vuln/WPSEC-2026-0242/
- https://plugins.svn.wordpress.org/ewww-image-optimizer/tags/8.8.0/
- https://wordpress.org/plugins/ewww-image-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS