https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:32:36.856111+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-379139 EUVD-2026-379139 2026-10-04T18:32:36.902334+00:00 EUVD-2026-379139 https://cve.radiocsirt.org/vuln/fkie_cve-2026-91072 fkie_cve-2026-91072 2026-10-04T18:32:36.902376+00:00

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.

 https://cve.radiocsirt.org/vuln/ghsa-6w6r-chf5-m436 GHSA-6w6r-chf5-m436 2026-10-04T18:32:36.902420+00:00

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.