CVE Catalog
CVE-2026-19223
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk0.37%
30th percentile - higher than 30% of all known CVEs
Summary
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Risk Assessment
An administrator of a single site can take control of the entire network, leading to full compromise of all sites and data.
Recommendation
Update the plugin to version 4.3.2 or later. Ensure only network administrators have access to network-wide settings.
Other vulnerabilities in Smush
Original NVD description (English source)
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.