CVE-2026-110039
CVE-2026-110039 · Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
CVSS 2.7 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
smush
- Versions
- ≥ 0, < 4.3.4: Affected (semver)
Update to 4.3.4