CVE-2026-110029: Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment
The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with at least the Subscriber role can exploit the affected AJAX action. The user does not need to own the targeted attachment.
What can an attacker do through the vulnerable action?
They can restore any attachment from its backup copy, permanently delete that backup, and delete WebP derivatives generated by the plugin. The impact is limited to integrity and availability; no confidentiality impact is indicated.
Which configurations are affected?
Affected sites are those running the Squeeze WordPress plugin before version 1.8.1 and allowing users to authenticate with Subscriber-level or higher accounts.
How can I check whether the issue may already have been abused?
Review attachment changes for unexpected restorations, missing backup copies, and deleted Squeeze-generated WebP derivative files, especially where the acting account was a Subscriber or did not own the attachment.