Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.7
CVE-2026-110039: Smush plugin lets single‑site admin change network settings
CVE-2026-110039 · published 2 days ago
Summary
The Smush image‑optimization plugin for WordPress (versions before 4.3.4) allows a site admin on a multisite installation to modify settings that affect every site on the network. This could unintentionally alter performance or privacy settings for all sites. Upgrade the plugin to version 4.3.4 or later, or restrict admin privileges until the update is applied.
What to do
- Update unknown smush to version 4.3.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | smush | < 4.3.4 |
Original advisory text
Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
References
- https://wpscan.com/vulnerability/4f27b2fd-1b27-4274-85c5-f19e6998aa44/ exploit vdb-entry technical-description
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.7
Low
Type
CWE-863Incorrect Authorization
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Track software like this
Free during beta