EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) PHP Object Injection via 'eio_page_settings' Post Meta
- ID
- WPSEC-2026-0243
- Plugin
- EWWW Image Optimizer (ewww-image-optimizer)
- Affected
- from 8.6.0 before 8.8.0
- Remediation
- Update to 8.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- EWWW Image Optimizer on WPSec AttackSurface
- Fix released
- Published
Description
The EWWW Image Optimizer plugin for WordPress is vulnerable to PHP Object Injection in versions 8.6.0 up to, and including, 8.7.7 via deserialization of the 'eio_page_settings' post meta value. The plugin passes the value already returned by get_post_meta() through an additional maybe_unserialize() call when loading per-page Lazy Load and Image Detective settings. This makes it possible for authenticated attackers with contributor-level access and above, who can add custom fields to their own posts, to store a serialized payload that is unserialized when the post is viewed, provided Lazy Load is enabled and a per-page exclusion has been saved on the site, or Image Detective is enabled and an administrator views the post. No known POP chain is present in the plugin itself; if a POP chain is present via another plugin or theme on the target site, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0243/
- https://plugins.svn.wordpress.org/ewww-image-optimizer/tags/8.8.0/
- https://wordpress.org/plugins/ewww-image-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS