{"id":"CVE-2026-118241","published":"2026-11-11T06:17:14.900","lastModified":"2026-11-11T06:17:14.900","description":"The Smush  WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/150305f1-4cfc-46d2-9b90-b2f84e2e1d7e/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}