The vulnerability exists in the EWWW Image Optimizer WordPress plugin prior to version 8.8.0. The migration routine for WebP derivative images fails to limit the target path to the current site's upload directory, allowing an attacker with administrator‑level privileges to rename or delete WebP files located outside the intended scope. This can affect other sites on a multisite network whose files the attacker normally cannot reach.

Any WordPress site that has installed the EWWW Image Optimizer plugin with a version earlier than 8.8.0 is affected. The clause specifically targets the WebP migration handler and applies whether the site is single‑site or part of a multisite network.

Exploitation requires access to an administrator account; the vulnerability does not permit remote code execution or affect non‑admin users. The lack of an EPSS score or KEV listing makes the exact exploitation likelihood uncertain, yet the ability to delete or rename assets on other sites elevates the risk for environments that trust internal administrators. The CVSS score is not provided in the data, so the severity must be judged on the potential impact rather than a quantified score.