Security Alert Summary
The Smush WordPress plugin before 4.3.4 contains a privilege restriction issue that can allow an administrator of a single site on a multisite network to change a network-wide access setting. This can result in unintended configuration changes applied across the entire network.
CVE Details
- CVE ID: CVE-2026-110039
- Affected component: Smush WordPress plugin (network-wide access setting)
- Affected versions: versions before 4.3.4 (less than 4.3.4)
- Published: October 16, 2026, 07:17:10 AM UTC
- Last modified: October 16, 2026, 03:17:09 PM UTC
- CVSS v3.1: Base score 2.7, Severity LOW, Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Requires an account with high privileges (Privileges Required: HIGH). No user interaction required (UI: NONE).
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-863 (Incorrect Authorization)
Technical Details
The plugin fails to restrict changes to a network-wide access setting to network administrators on multisite installations. Specifically, an administrator of a single site on a multisite network can change a setting that should be limited to network administrators, due to an insufficient authorization restriction on the operation that modifies the network-wide access setting.
This is a privilege restriction/authorization weakness. The description indicates a missing or inadequate check that differentiates a single-site administrator from a network administrator when applying changes that affect the entire network.
Impact is limited to incorrect modification of a network-wide configuration. The CVSS data indicates integrity impact is low and there is no direct confidentiality or availability impact indicated.
How This Could Impact Your Website
On a multisite WordPress install, imagine a site owner and several internal staff accounts for individual sites, plus an external contractor who administers a single site. If one of those single-site administrators changes the network-wide access setting unintentionally or maliciously, the change could apply across all sites on the network, altering behavior or access for many sites at once.
Practical consequences include unexpected changes to network configuration that might expose internal user lists or enable workflows different from those intended by the network administrator. That could increase the risk of targeted phishing or social engineering against staff if email addresses or other contact details become more broadly accessible as a result of configuration changes.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially site administrators on multisite where network-wide settings exist.
- Enforce strong passwords and two-factor authentication for editors, administrators, and any high-privilege accounts.
- Remove unused or unmaintained plugins from the network.
- Monitor site and network activity logs for unusual configuration changes or administrative actions.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
