Unauthorized File Manipulation in EWWW Image Optimizer WordPress Plugin

Executive Summary

The EWWW Image Optimizer WordPress plugin before version 8.8.0 has a flaw where a file migration routine for WebP images does not restrict operations to the current site's uploads directory. This allows an administrator to rename or delete WebP files outside that directory, including files from other sites in a multisite network.

Useful 0 Not Useful 0

Detection Guidance

Check the EWWW Image Optimizer plugin version. If it is below 8.8.0, the vulnerability is present. Review file access logs for unauthorized renaming or deletion of WebP files outside the uploads directory.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator access could delete or rename critical WebP image files outside the intended directory. On multisite networks, this could affect files belonging to other sites, potentially causing data loss or disruption to unrelated sites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or modification of image files across different sites in a multisite network. If an attacker exploits this to access or alter files belonging to other sites, it may violate data integrity or confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the EWWW Image Optimizer plugin to version 8.8.0 or later immediately. Restrict Administrator-level access to only trusted users. Monitor file system activity for suspicious changes to WebP files.

Useful 0 Not Useful 0