CVE-2026-110039
Received Received - Intake

Smush WordPress Plugin Network Access Bypass

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110039
EUVD
EUVD-2026-102695

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Smush 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Smush WordPress plugin before version 4.3.4 has an authorization flaw. A single site administrator on a multisite network can change network-wide settings that should only be modifiable by network administrators.

Detection Guidance

Check the installed version of the Smush plugin in WordPress. If it is below 4.3.4, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

An attacker with single site admin access could alter network-wide plugin settings, potentially disabling security features or changing configurations across all sites in the network.

Compliance Impact

This vulnerability could lead to unauthorized changes in data handling or security settings, potentially violating compliance requirements for GDPR or HIPAA if such changes affect protected data processing.

Mitigation Strategies

Update the Smush plugin to version 4.3.4 or later immediately. Ensure only network administrators have access to network-wide settings in multisite networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110039. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart