The EWWW Image Optimizer WordPress plugin versions 8.6.0 through 8.7.7 allow authenticated users with author-level permissions to store a crafted serialized value in the post meta field "eio_page_settings". When a post that contains this field is rendered, the plugin unserializes the value, resulting in PHP Object Injection. An attacker who can supply a malicious object can chain gadgets present in other vulnerable EWWW Image Optimizer installations to achieve remote code execution. This flaw is a classic deserialization vulnerability and can compromise confidentiality, integrity, and availability of the affected site.

The vulnerability affects the EWWW Image Optimizer plugin for WordPress, specifically versions 8.6.0 to 8.7.7. Any installation that grants author or higher roles the ability to edit or publish content may be susceptible. The issue is tied to the plugin’s handling of eio_page_settings post meta and is not limited to a particular configuration beyond author-level permission. No other vendors or products are listed as affected.

The CVSS score is 6.6, indicating Medium severity. Exploitation requires an authenticated author, making it more targeted than a public exploit. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no known widespread exploitation has been reported yet. Nevertheless, because the flaw can be leveraged to run arbitrary code with the privileges of the web application, stakeholders should treat it as a critical risk until a fix is applied.