EWWW Image Optimizer CVE-2026-91072

Requires the attacker to already hold WordPress Administrator-level access (PR:H) and, for the most impactful cross-tenant case, the target must be a WordPress MULTISITE network so that renaming/deleting files 'belonging to a different site' becomes a genuine authorization-boundary violation. The specific trigger is the plugin's WebP-derivative file migration routine, which fails to confine operations to the current site's own uploads directory. Limiting factors: administrative privilege is a high bar, AC:H reflects the non-trivial path/scope conditions, no user interaction is needed (UI:N), and on a standalone single-site install the practical benefit to an already-privileged admin is minimal - the meaningful risk is specifically multisite tenant isolation.

This is a low-priority, high-CVSS-context-notwithstanding issue: the raw CVSS 3.1 base score is only 4.4 and every real-world signal reinforces low urgency. The vector requires PR:H (Administrator-level access) and AC:H, and impact is limited to I:L/A:L with C:N - an attacker can rename or delete WebP-derivative files but gains no confidentiality and no code execution. CISA's SSVC framework aligns cleanly: Exploitation 'none', Automatable 'no', Technical Impact 'partial'. There is no EPSS score provided, no CISA KEV listing, and no public exploit - so the exploitation status is 'no public exploit identified at time of analysis'. The one nuance worth verifying is the S:C (scope change): it is justified by the multisite case where one site's administrator can affect a DIFFERENT site's files, which is a genuine authorization-boundary crossing; on a standalone (non-multisite) install the practical impact is far smaller since the admin already controls their own uploads. Note the input 'Information Disclosure' tag conflicts with the CVSS vector (C:N) - this is a file rename/delete integrity-and-availability issue, not disclosure. Net: a legitimate multisite tenant-isolation weakness but gated behind admin privileges with only partial integrity/availability impact - not a widespread-exploitation priority.

On a WordPress multisite network, an attacker who holds Administrator rights on one site invokes the plugin's WebP-derivative migration routine and supplies a path that escapes their own site's uploads directory. Because the routine does not confine operations to the current site's scope, they rename or delete WebP image files belonging to another site they have no legitimate access to, causing broken images or content loss on that victim site. No public exploit code is identified at the time of analysis, and exploitation requires the high AC/PR conditions reflected in the CVSS vector.