CVE-2026-118241 | Smush Plugin up to 4.3.5 on WordPress Media Attachment authorization

November 11, 2026 Yanac

A vulnerability marked as problematic has been reported in Smush Plugin up to 4.3.5 on WordPress. Impacted is an unknown function of the component Media Attachment. This manipulation causes authorization bypass.

The identification of this vulnerability is CVE-2026-118241. It is possible to initiate the attack remotely. There is no exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More