CVE-2026-118241 · Package
NO FIX YET · SEE WHAT TO DO
The Smush WordPress plugin before 4.3.6 checks only a broad upload capability, not ownership, before acting on media attachments. An logged-in author can optimise or restore attachments owned by other users, changing files on disk and consuming their stored backups.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Smush image optimisation plugin before 4.3.6 that have users with the Author role or above. An attacker needs a logged-in account with at least Author rights, and can only act on media owned by other users. Sites without Smush, or with only administrators and editors, are not exposed.
Not affected if no-author-accounts, plugin-at-4.3.6-or-later
Who cares self-hosted, smush, wordpress
smush.php header; versions below 4.3.6 are affected.4.3.6 (versions before this are affected, per the advisory).The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.