Description

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-27T06:16:56.803Z",
  "pubdate": "2026-08-27T06:16:56.803Z",
  "executiveSummary": "The Smush WordPress plugin, in versions prior to 4.3.2, contains a critical security vulnerability involving improper access control in a multisite network configuration.\nThe flaw stems from the failure to restrict access to network-wide settings, permitting site-level administrators to modify configurations that are intended to be managed exclusively by network administrators.\nThis vulnerability constitutes an Insecure Direct Object Reference (IDOR) or privilege escalation scenario, enabling a malicious actor with site-level administrative privileges to execute arbitrary code across the entire WordPress multisite network environment.\nThe impact is severe, as it facilitates full-system compromise, cross-site contamination, and potential data exfiltration or total loss of administrative control over the network infrastructure.\nExploitation requires the attacker to possess site-level administrative credentials within the affected multisite installation.\nGiven the scope of the potential impact, this vulnerability represents a high-risk scenario for organizations utilizing the Smush plugin in a multisite deployment.",
  "technicalDetails": "The vulnerability resides in the Smush WordPress plugin's implementation of administrative setting management. In a WordPress Multisite environment, certain plugin configurations are defined as global or network-wide settings, which must only be accessible to Network Administrators (Super Admins) to maintain system integrity.\nThe root cause is a deficiency in the authorization check mechanism within the plugin's settings management interface. Specifically, the code fails to verify that the requesting user possesses the 'manage_network_options' capability or a equivalent high-level network administrative privilege before processing requests to update specific plugin configurations.\nBecause the input validation and access control checks are insufficient, a site-level administrator—who normally lacks permissions to affect global plugin behaviors—is able to invoke functions that modify network-wide parameters. If these parameters interact with file system paths, execution hooks, or sensitive system configurations, an attacker can leverage this access to inject malicious code.\nThe exploitation flow proceeds as follows: First, an attacker authenticates as an administrator of an individual site within the network. Second, the attacker targets the insecure endpoint or API route responsible for updating Smush plugin settings. Third, by crafting a request that alters global settings, the attacker bypasses the intended boundary between the individual site and the network-wide plugin configuration.\nUpon successful submission of the malicious configuration data, the plugin executes the requested changes. If the configuration allows for the modification of upload paths, inclusion of external assets, or execution of arbitrary code via unsanitized inputs, the attacker can force the server to execute malicious PHP code or payload scripts.\nThe payload behavior is characterized by its ability to break out of the context of the sub-site. By gaining arbitrary code execution capability at the network level, the attacker essentially gains the same privileges as the network-wide administrator, allowing for the deployment of webshells, persistent backdoors, or complete database manipulation throughout the entire multisite instance. This cross-site impact is the defining characteristic of this vulnerability, as a single compromised site-level administrator can now influence the entire network infrastructure, including the main site and other hosted sub-sites."
}