CVE-2026-110029
Deferred Deferred - Pending Action

Squeeze Plugin Authenticated Attachment Deletion and Backup Removal

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110029
EUVD
EUVD-2026-102838

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Squeeze 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin Squeeze versions before 1.8.1. It involves a missing authorization check in an AJAX action called squeeze_restore_attachment. This flaw allows authenticated users with the Subscriber role or higher to restore any attachment to its backup copy, permanently delete the backup, and remove the plugin's generated WebP derivatives, regardless of ownership.

Detection Guidance

Check if the Squeeze WordPress plugin version is below 1.8.1 by inspecting the plugin files or WordPress admin panel. Look for unauthorized AJAX requests to squeeze_restore_attachment or unusual deletion of attachments or WebP derivatives.

Impact Analysis

An attacker with a low-privileged account like Subscriber could delete important backups or WebP image derivatives, disrupting site functionality or causing data loss. They could also restore attachments to outdated versions, potentially reverting legitimate changes.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to modify or delete attachments, which may include sensitive data. Unauthorized changes to backups or derivatives could lead to data integrity issues or loss of audit trails, violating principles of data protection and confidentiality required by these regulations.

Mitigation Strategies

Update the Squeeze plugin to version 1.8.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review user roles and permissions to ensure no unnecessary elevated access exists.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110029. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart