CVE-2026-118241

— UNSCORED

Published 2026-11-11 · Updated 2026-11-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.

All references

https://wpscan.com/vulnerability/150305f1-4cfc-46d2-9b90-b2f84e2e1d7e/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.