CVE-2026-81285: WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability
Published Aug 28, 2026
·Updated
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
Affected Software
1 affected component
wordpress/smush-image-compression-and-optimization<=4.2.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/smush-image-compression-and-optimizationto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Aug 28, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
WordPress sites using Smush Image Compression and Optimization version 4.2.0 or earlier are affected.
2
Does exploitation require an authenticated WordPress user or user interaction?
No. The vulnerability is remotely exploitable without privileges or user interaction.
3
What is the expected security impact?
The impact is denial of service: availability may be affected. The provided CVSS vector indicates no confidentiality or integrity impact.