EUVD-2026-67728
GHSA-p96r-537r-m99j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate target WordPress plugin versions
-
DeliveryIdentify Smush ≤ 4.2.0 installation
-
ExploitSend flood of unauthenticated HTTP requests to vulnerable endpoint
-
ExecutionTrigger unthrottled server-side image processing
-
PersistExhaust CPU or memory resources
-
ImpactDeny service to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of the Smush WordPress plugin. Any WordPress site with the Smush plugin installed and active at version ≤ 4.2.0 is exposed. Exploitation is limited to availability impact only (C:N/I:N) and does not grant code execution or data access. Hosting environments with upstream rate limiting, DDoS protection, or strict request throttling may reduce the practical impact of exploitation but do not eliminate the underlying vulnerability. |
| Impact | The CVSS 7.5 High score is well-supported by the vector metrics: AV:N (no network proximity required), AC:L (no special conditions or race conditions), PR:N (no account or session), UI:N (fully server-side), and A:H (full availability loss possible). The attack is as simple as it gets - no authentication, no complexity barrier, no user interaction. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no public POC code was identified, suggesting opportunistic exploitation has not yet been widely observed. However, given Smush's large install base on publicly accessible WordPress sites and the trivial exploitation bar, the real-world risk is elevated - any attacker capable of sending HTTP requests can attempt this. The absence of confidentiality or integrity impact (C:N/I:N) limits the blast radius to availability disruption rather than data breach. |
| Exploit ScenarioDerived | An attacker with no credentials identifies a WordPress site running Smush ≤ 4.2.0 (detectable via plugin enumeration or HTTP headers) and sends a high volume of crafted HTTP requests to the plugin's unauthenticated resource-intensive endpoint. Each request triggers server-side image processing that consumes significant CPU or memory, and the absence of throttling allows the attacker to sustain this until the web server becomes unresponsive to legitimate traffic. No public POC exists at time of analysis, but the attack requires only basic HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
RemediationAI
The primary remediation is to update the Smush plugin to a version beyond 4.2.0; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-smushit/vulnerability/wordpress-smush-image-compression-and-optimization-plugin-4-2-0-denial-of-service-attack-vulnerability for the confirmed patched release version, which was not explicitly stated in the available input data. If an immediate update is not possible, compensating controls include configuring a web application firewall (WAF) rule to rate-limit or block requests to the specific AJAX or REST API endpoint exercising the vulnerable code path - note this requires identifying the exact endpoint name and may break legitimate plugin functionality. Alternatively, temporarily deactivating the Smush plugin eliminates exposure entirely at the cost of image optimization features. WordPress hosting platforms with built-in rate limiting (e.g., Cloudflare, Sucuri) can provide an additional throttling layer while patching is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the Smush Image Compression and Optimization plugin by WPMU Dev (CPE: cpe:2.3:a:wpmu_dev:smush_image_compression_and_optimization:*:*:*:*:*:*:*:*), a widely-deployed WordPress plugin that performs server-side image processing operations including compression, resizing, and optimization. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: one or more plugin endpoints can be triggered by unauthenticated HTTP requests, initiating resource-intensive image processing operations without rate limiting or authentication gating. In WordPress plugins, such endpoints are commonly exposed via AJAX handlers (wp_ajax_nopriv_*) or REST API routes. When called repeatedly, these operations can saturate CPU, memory, or I/O capacity, denying service to legitimate site visitors.
Know when Smush Image Compression And Optimization gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable resource exhaustion with no complexity barrier; availability-only impact with no scope change.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
Executive ViewAI
The Smush Image Compression and Optimization plugin is subject to an unauthenticated denial-of-service vulnerability allowing attackers to exhaust WordPress server resources and disrupt service availability without credentials or user interaction. All organizations running affected versions (4.2.0 and earlier) face immediate risk of unplanned downtime, with no currently available vendor patch to resolve the issue. Swift identification and interim controls are essential to protect service continuity.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) disabling the plugin if operationally feasible; (2) implementing rate limiting and request throttling at the web server or plugin level; (3) deploying WAF rules to detect and block repetitive compression requests from single sources; (4) configuring server resource limits (CPU/memory quotas) to restrict per-request resource consumption; (5) monitoring application logs and server performance metrics for exploitation indicators such as resource consumption spikes or excessive plugin errors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. Rated high se
Exploit-DB