CVE-2016-20010: 
WordPress vulnerability analysis and mitigation

EWWW Image Optimizer before version 2.8.5 contains a remote code execution vulnerability (CVE-2016-20010). The vulnerability was disclosed on May 5, 2021, affecting WordPress installations using this plugin. The security issue stems from the plugin's reliance on a protection mechanism involving the PHP boolval function, which is unavailable in PHP versions before 5.5 (CVE Details).

The vulnerability has received a CVSS v3 Base Score of 10.0 Critical, with an Impact Score of 6.0 and Exploitability Score of 3.9. The attack vector is network-based (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), and requires no user interaction (UI:N). The scope is changed (S:C), with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (AttackerKB).

The vulnerability allows remote attackers to execute arbitrary commands on the affected system. This could lead to complete system compromise, with high impacts on the confidentiality, integrity, and availability of the affected WordPress installation (CVE Details).

The vulnerability is exploitable over the network and requires no special privileges or user interaction. The attack complexity is rated as low, making it relatively straightforward to exploit (AttackerKB).

The vulnerability was fixed in EWWW Image Optimizer version 2.8.5. Users are advised to update to this version or later to mitigate the risk (WPScan).