CVE-2016-20010 EWWW Image Optimizer <= 2.8.4 - Remote Code Execution

CriticalCVSS 10.0 EPSS 3.7%

Published: 2021-05-05 16:42
Updated: 2026-06-17 03:43
Exploit status: No public exploit known

Description

EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.

Affected products

Product	Affected versions	Fixed in
ewww image optimizer	< 2.8.5	2.8.5
wordpress ewww-image-optimizer(WordPress)	< 2.8.5	2.8.5

References

plugins.trac.wordpress.org release-notes third-party-advisory
www.wordfence.com third-party-advisory
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.1

10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

All scores (3)

v3.1 10.0 · nvd@nist.gov
v3.1 9.6 · wordfence
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 3.70% (percentile 89.9)
CWE: CWE-94 Improper Control of Generation of Code

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.