Executive brief
The Squeeze WordPress plugin, used to optimize images on websites, contains a file upload vulnerability that allows authenticated authors and higher-privileged users to upload malicious PHP files disguised as image data. This bypasses normal upload restrictions and enables attackers to execute arbitrary code on the web server with full control over the website and its data.
Technical details
The plugin fails to validate file type and extension when processing per-size image data through the squeeze_update_attachment AJAX action. Authenticated users with the upload_files capability (Author role and above) can submit crafted multipart POST requests containing base64-encoded PHP payloads in the base64Sizes parameter, which are then decoded and written directly to the uploads directory without extension or content verification. The vulnerability requires a valid WordPress nonce and prior authentication, but allows remote code execution as the web server user. The issue is fixed in version 1.7.12.
Affected products
- Squeeze Squeeze before 1.7.12
Timeline
- 2026-08-06: disclosed
- 2026-08-10: patched: Version 1.7.12 released