CVE-2026-118241: Smush < 4.3.6 - Author+ Optimization and Restoration of Others' Attachments via IDOR

Q: Which users can exploit this issue?

Any authenticated WordPress user with the Author role or higher who has the upload-files capability can exploit it. The user does not need to own the targeted media attachment.

Q: What access does an attacker need?

An attacker needs a WordPress account with upload-files capability and must be able to target another user's attachment. Exploitation affects media attachments owned by other users.

Q: What can a successful attacker do?

They can optimise or restore other users' attachments, altering the associated files on disk. They can also consume the stored backup for the targeted attachment.

Q: Are sites running an affected version exposed by default?

The issue is present because the plugin checks the broad upload-files capability rather than authorization for the specific attachment. Sites where Author or higher roles have that capability may be exposed to actions against attachments owned by other users.

Published Nov 11, 2026

Updated

The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.

Affected Software

1 affected component

WPMU DEV Smush<4.3.6

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with the Author role or higher who has the upload-files capability can exploit it. The user does not need to own the targeted media attachment.

What access does an attacker need?

An attacker needs a WordPress account with upload-files capability and must be able to target another user's attachment. Exploitation affects media attachments owned by other users.

What can a successful attacker do?

They can optimise or restore other users' attachments, altering the associated files on disk. They can also consume the stored backup for the targeted attachment.

Are sites running an affected version exposed by default?

The issue is present because the plugin checks the broad upload-files capability rather than authorization for the specific attachment. Sites where Author or higher roles have that capability may be exposed to actions against attachments owned by other users.

CVE-2026-118241: Smush < 4.3.6 - Author+ Optimization and Restoration of Others' Attachments via IDOR

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What access does an attacker need?

What can a successful attacker do?

Are sites running an affected version exposed by default?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What access does an attacker need?

What can a successful attacker do?

Are sites running an affected version exposed by default?