The EWWW Image Optimizer WordPress plugin before version 8.8.0 fails to constrain the WebP‑derivative file migration routine to the site's own uploads directory, enabling an attacker with administrator privileges to rename or delete WebP images located outside that scope. This flaw can affect other sites on a multisite network, exposing assets that the attacker normally cannot reach, which leads to integrity and availability issues for those sites.

Any WordPress installation that has the EWWW Image Optimizer plugin with a version older than 8.8.0 is affected. The vulnerability is triggered by the WebP migration handler and applies whether the site is a single site or part of a multisite network.

Exploitation requires administrator access to WordPress; remote code execution is not possible. The EPSS score of less than 1 % and the absence of inclusion in the CISA KEV catalog suggest a low likelihood of exploitation. However, the capacity to delete or rename assets on other sites within a multisite network increases the risk for environments that trust internal administrators. The CVSS score of 4.4 reflects moderate severity, indicating a potentially significant impact on the integrity and availability of site assets.