WordPress Plugin Vulnerability Report: EWWW Image Optimizer – Sensitive Information Exposure

Plugin Name: EWWW Image Optimizer

Key Information:

  • Software Type: Plugin
  • Software Slug: ewww-image-optimizer
  • Software Status: Active
  • Software Author: nosilver4u
  • Software Downloads: 33,159,954
  • Active Installs: 1,000,000
  • Last Updated: September 7, 2023
  • Patched Versions: 7.2.1
  • Affected Versions: <7.2.1

Vulnerability Details:

  • Name: EWWW Image Optimizer <= 7.2.0 - Sensitive Information Exposure
  • Type: Information Exposure
  • CVSS Score: 5.3 (medium)
  • Publicly Published: September 8, 2023
  • Researcher: September 8, 2023
  • Description: The plugin is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations.


The EWWW Image Optimizer for WordPress has a vulnerability in versions up to and including those less than 7.2.1 that exposes sensitive information. This vulnerability has been patched in version 7.2.1.

Detailed Overview:

This vulnerability was publicly disclosed on September 8, 2023. It allows unauthenticated attackers to gain access to sensitive information such as installation paths, file permissions, and various plugin settings. The issue arises due to the plugin saving debug logs in predictable locations, which can be exploited.

Risks of Vulnerability:

  • Unauthorized access to sensitive information
  • Compromise of the integrity of WordPress installations
  • Potential leveraging of the exposed information for further attacks

Vulnerability Remediation:

The plugin developers have released a patch for this vulnerability in version 7.2.1.

Advice for Users:

  • Immediate Action: Update to version 7.2.1 as soon as possible to mitigate the risks associated with this vulnerability.
  • Check for Signs of Vulnerability: Examine your server logs and plugin logs for any suspicious activities that might indicate your site has been compromised.
  • Alternate Plugins: While a patch is available, users might still consider plugins that offer similar functionality as a precaution.
  • Stay Updated: Always ensure that your plugins are updated to the latest versions to avoid vulnerabilities.


The prompt response from the plugin developers to patch this vulnerability underscores the importance of timely updates. Users are advised to ensure that they are running version 7.2.1 or later to secure their WordPress installations.


Detailed Report

Keeping your WordPress site secure should be a top priority - but it's easy to fall behind on updates for plugins, themes, and core software. Unfortunately, outdated software is susceptible to vulnerabilities that can compromise your site. One such vulnerability has recently been disclosed for the popular EWWW Image Optimizer plugin.

With over 1 million active installs, the Image Optimizer helps thousands of WordPress sites optimize images. However, versions up to and including 7.2.0 contain an information exposure vulnerability. This issue, with a CVSS score of 5.3 (medium severity), allows attackers to gain access to sensitive data if exploited.

Specifically, the vulnerability arises because the plugin saves debug logs in predictable locations. This can expose installation paths, file permissions, and plugin settings if accessed by unauthorized parties. While medium risk, this vulnerability can potentially enable further attacks on sites.

The good news is the plugin developers have released a patch in version 7.2.1. All users should update as soon as possible to mitigate any risks. Be sure to check your server and plugin logs for any suspicious activity indicating previous compromise. Alternate image optimization plugins can also be considered as a precaution.

This is not the first vulnerability found in the EWWW Image Optimizer. Previous issues enabled cross-site request forgery and remote code execution on vulnerable versions. The plugin developers have responsibly patched issues when reported. However, staying up-to-date remains crucial.

As a WordPress site owner, staying on top of vulnerabilities can be challenging. But maintaining secure, updated software is essential to protecting your site. If you need any help updating plugins or assessing vulnerabilities, don't hesitate to reach out. We know security can easily fall through the cracks when managing a small business. But we're here to help keep your site safe.

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WordPress Plugin Vulnerability Report: EWWW Image Optimizer – Sensitive Information Exposure FAQs

Leave a Comment