Smush
Monthly
Improper authorization in the Smush WordPress plugin before 4.3.4 lets an administrator of a single subsite on a WordPress multisite network change a network-wide access setting that should be modifiable only by a network super-administrator. Only multisite deployments running Smush versions earlier than 4.3.4 are exposed, and the attacker must already hold the administrator role on at least one subsite (PR:H, per the supplied vector), so the issue is not reachable by unauthenticated or low-privilege users. Impact is limited to modification of a configuration value - no data disclosure or service disruption - and public exploit code exists, though EPSS is only 0.14% (3rd percentile) and there is no evidence of active exploitation; the vendor has released a fix in Smush 4.3.4.
Improper authorization in the Smush WordPress plugin before 4.3.4 lets an administrator of a single subsite on a WordPress multisite network change a network-wide access setting that should be modifiable only by a network super-administrator. Only multisite deployments running Smush versions earlier than 4.3.4 are exposed, and the attacker must already hold the administrator role on at least one subsite (PR:H, per the supplied vector), so the issue is not reachable by unauthenticated or low-privilege users. Impact is limited to modification of a configuration value - no data disclosure or service disruption - and public exploit code exists, though EPSS is only 0.14% (3rd percentile) and there is no evidence of active exploitation; the vendor has released a fix in Smush 4.3.4.