Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2026-110039

Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

Description

The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Smush

Default version status: unaffected

  • 0 to < 4.3.4affected

References