Smush WordPress Plugin EUVD-2026-102695

Exploitation requires a WordPress multisite network deployment running Smush before 4.3.4, and the attacker must already hold the administrator role on at least one subsite within that network (but need not be a network super-administrator). The specific prerequisite is the multisite network-wide access setting that the plugin fails to restrict to network administrators. Key limiting factors: standard single-site WordPress installations are not affected because the network-wide setting does not exist there; the attacker must be an authenticated subsite administrator (PR:H), so this is not reachable by unauthenticated or low-privilege users; and only integrity of a configuration setting is affected, with no data disclosure or service disruption.

This is a genuinely low-priority issue despite being publicly exploitable. The CVSS base score of 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) reflects the core limiter: PR:H means the attacker must already hold administrator privileges on a subsite, so this is a privilege-boundary violation (CWE-863, improper authorization) rather than a path to initial compromise. Impact is limited to integrity (I:L) with no confidentiality or availability consequence. The signals are mutually consistent and point to low real-world urgency: EPSS is 0.14% (3rd percentile), indicating very low predicted exploitation likelihood, and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. Publicly available exploit code exists (via WPScan), but POC availability is a distinct signal from active exploitation and does not by itself raise priority here. One nuance worth verifying: the CVSS vector is AV:N/S:U, but the real-world effect is a trusted single-site admin escaping their scope to alter a setting governing the entire multisite network - arguably a scope change (S:C), which NVD did not capture. Even under that stricter reading the severity remains low. Net: a real but low-severity insider/privilege-escalation-within-admin-tier bug affecting only multisite deployments; patch in normal cadence rather than emergency.

On a WordPress multisite network running Smush before 4.3.4, a user who is administrator of only a single subsite (but not a network super-admin) submits a request to change the plugin's network-wide access setting, and the plugin fails to verify network-admin privileges, letting that change take effect across every site on the network. Because the attacker must already be an authenticated subsite administrator (PR:H), this is a privilege-boundary escalation within the admin tier rather than an external break-in. Publicly available exploit code (WPScan) demonstrates the request.