Live › vulnerability › CVE-2026-110039
Go to dashboardBefore version 4.3.4, the Smush WordPress plugin lets an administrator of a single site on a multisite network change a network-wide access setting that should only be changed by network administrators. The change then applies to the entire network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Smush plugin on a WordPress multisite network, where individual site administrators exist alongside network administrators. Single-site WordPress installs are not affected by this privilege issue.
No product ranges from the sources yet.
wp plugin get wp-smushit --field=versionwp core is-installed --network4.3.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
This page as .md · .json · in your agent: get_signal("CVE-2026-110039")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.