CVE-2026-118241
LOW
NVD
CVSS Score
2.7
Severity
LOW
Published
Nov 11, 2026
Vendor
unknown
Description
The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.