Smush Image Compression And Optimization
Monthly
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated denial of service in Smush Image Compression and Optimization plugin (versions ≤ 4.2.0) allows any remote attacker to exhaust WordPress server resources without credentials or user interaction. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms trivial, unauthenticated network exploitation with high availability impact, making every site running an affected version an easy target for sustained disruption. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity means exploitation requires minimal skill.
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.