CVE-2026-110039: Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

Q: Who can exploit this issue?

An administrator of any individual site within a WordPress multisite network can change the affected network-wide access setting. The issue does not require network administrator privileges.

Q: Are single-site WordPress installations affected?

The described impact applies to WordPress multisite networks because it involves a network-wide setting. The provided information does not indicate an impact on single-site installations.

Q: What should be remediated?

Update WPMU DEV Smush to version 4.3.4 or later. Versions before 4.3.4 are affected according to the provided information.

Published Oct 16, 2026

Updated

The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

Affected Software

1 affected component

WPMU DEV Smush<4.3.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Smush WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.3.4

Event History

Oct 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An administrator of any individual site within a WordPress multisite network can change the affected network-wide access setting. The issue does not require network administrator privileges.

Are single-site WordPress installations affected?

The described impact applies to WordPress multisite networks because it involves a network-wide setting. The provided information does not indicate an impact on single-site installations.

What should be remediated?

Update WPMU DEV Smush to version 4.3.4 or later. Versions before 4.3.4 are affected according to the provided information.

CVE-2026-110039: Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are single-site WordPress installations affected?

What should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are single-site WordPress installations affected?

What should be remediated?