Squeeze WordPress Plugin EUVD-2026-102838

Exploitation requires an authenticated WordPress account of at least Subscriber level (CVSS PR:L), so the practical prerequisite is either open user registration being enabled on the target site or the attacker otherwise obtaining any low-privileged account. The specific trigger is one AJAX action in the Squeeze plugin (versions before 1.8.1) that omits a capability check, allowing cross-ownership reversion and permanent deletion of attachment backups and generated WebP derivatives. Limiting factors: no admin/editor privileges are needed but a valid login is mandatory (not unauthenticated), no user interaction is required from a victim, and sites that disallow untrusted registrations and have no low-trust accounts are effectively not exploitable by external attackers.

This is a genuine but moderate-priority issue, best characterized as a broken-access-control (missing authorization) flaw rather than the critical class its CVSS might superficially suggest. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) is internally consistent with the description: network-reachable AJAX endpoint, low complexity, and crucially PR:L reflecting that an authenticated account (Subscriber) is required - this is the single biggest limiting factor. Impact is correctly scoped to integrity and availability (reverting attachments, permanently deleting backups and WebP derivatives) with no confidentiality impact (C:N), which directly contradicts the 'Information Disclosure' tag in the input metadata - that tag appears mislabeled and should be treated as a data-integrity/missing-authorization issue instead. Public exploit code exists (reported by WPScan), which raises practical exploitability, but this is NOT the same as active exploitation: the CVE is not in CISA KEV and no EPSS score was provided, so there is no evidence of in-the-wild or widespread automated exploitation. The requirement for an authenticated account, even a low-privileged one, means risk is highest on sites permitting open user registration; on sites with no untrusted user accounts, realistic risk is substantially lower. SSVC-style read: exploitation is 'poc' (not 'active'), technical impact is 'partial', and automatability is limited by the authentication prerequisite.

On a WordPress site running Squeeze below 1.8.1 that allows self-registration, an attacker registers a free Subscriber-level account and logs in. They then send a crafted AJAX request to the unprotected action, reverting arbitrary attachments (regardless of ownership) to their backup and permanently deleting those backups and generated WebP derivatives, causing irreversible loss of optimized media. A public exploit/advisory from WPScan documents the technique, lowering the skill barrier.