CVE-2026-91051
Last modified
CVE-2026-91051 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or ..
Description
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | EWWW Image Optimizer | >= 8.6.0, < 8.8.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-91051?
How severe is CVE-2026-91051?
How do I fix CVE-2026-91051?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91043Allocation of Resources Without Limits or Throttling vulnera…8.2
- CVE-2026-91046The ElementsReady Addons for Elementor WordPress plugin thro…4.3
- CVE-2026-91047The ElementsReady Addons for Elementor WordPress plugin thro…5.3
- CVE-2026-91048The jdbc shell command scope shipped no org.apache.karaf.com…9.8
- CVE-2026-9105An authenticated stack-based buffer overflow vulnerability e…6.5
- CVE-2026-91050The Appointment Booking Plugin – LatePoint | Calendar & Sche…4.3
- CVE-2026-91057`_gx_multi_line_text_view_display_info_get()` reads one byte…4.6
- CVE-2026-91059The GUIX JPEG software decoder enforces no ordering on JPEG …6.8
- CVE-2026-9106A UI misrepresentation vulnerability was identified in GitHu…5.5
- CVE-2026-9107The Kali Forms — Contact Form & Drag-and-Drop Builder plugin…6.4
- CVE-2026-91072The EWWW Image Optimizer WordPress plugin before 8.8.0 does …4.4
- CVE-2026-91073The Subscribe Forms WordPress plugin before 1.6.3 does not …6.8
Are you affected by CVE-2026-91051?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST