CVE WATCH / VULNERABILITY DETAIL
CVE-2026-91051
MEDIUMCVSS 6.6NVD feed
Published 30 September 2026 · tracked since 30 September 2026
Description
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog