Improper Access Control in Smush Plugin for WordPress
CVE-2026-118241
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-118241?
The Smush plugin for WordPress, prior to version 4.3.6, has a significant flaw in its access control mechanism. It inadequately verifies user authorization when optimizing and restoring media attachments, allowing users with the Author role and above to manipulate files owned by other users. This oversight not only permits unauthorized alterations to media files but also leads to unnecessary consumption of storage resources for backups.
Affected Version(s)
Smush 0 < 4.3.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.