Description

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T16:18:29.243Z",
  "pubdate": "2026-08-28T16:18:29.243Z",
  "executiveSummary": "The Smush Image Compression and Optimization plugin for WordPress, in versions 4.2.0 and below, is susceptible to an unauthenticated Denial of Service (DoS) vulnerability.\nThis vulnerability allows remote, unauthenticated attackers to exhaust server resources by triggering computationally expensive image processing tasks.\nBy manipulating specific parameters or requests directed at the plugin's image handling functions, an adversary can force the server to initiate excessive compression or optimization cycles.\nThe primary impact of this flaw is the exhaustion of CPU and memory resources, potentially rendering the affected web application unresponsive to legitimate users.\nNo prior authentication or specific user privileges are required to initiate the attack, making the vulnerability highly accessible to external threat actors.\nThe risk is significant due to the simplicity of exploitation and the potential for service disruption without requiring access to the WordPress administrative backend.",
  "technicalDetails": "The vulnerability resides within the image processing logic of the Smush Image Compression and Optimization plugin, specifically in how the plugin handles requests to perform compression operations on image files.\nThe root cause is improper input validation and rate limiting on the endpoints responsible for triggering image optimization tasks. The plugin fails to sufficiently vet the parameters provided in the request before committing server-side resources to perform CPU-intensive image compression algorithms.\nAn unauthenticated attacker can exploit this by repeatedly sending specially crafted HTTP requests to the vulnerable endpoint. When the plugin receives these requests, it attempts to process or re-process the target images regardless of the user's authorization status.\nThe attack flow follows a predictable sequence: First, the attacker identifies the URI pattern used by Smush to trigger its optimization routines. Second, the attacker sends a high volume of requests targeting either existing images on the server or maliciously crafted files that force the plugin to undergo maximum compression processing.\nAs the server executes these requests, it consumes significant CPU cycles and memory. Under sufficient request frequency, the server's thread pool becomes exhausted, causing a queue of pending requests that degrades performance and ultimately leads to a complete denial of service for all users.\nBecause the plugin does not verify the identity of the requester, the process is entirely exposed to the public network. This allows for automated script-based exploitation where an attacker can launch a sustained, resource-exhausting attack with minimal effort.\nThe vulnerability affects all versions of Smush Image Compression and Optimization up to and including 4.2.0. The lack of validation on the initiator of these requests within the core image optimization functions enables this unauthorized resource consumption.\nPost-exploitation, the attacker has successfully degraded or terminated the service availability of the hosting environment. There is no evidence of remote code execution or unauthorized data modification, but the disruption of service acts as an effective availability attack."
}