Executive brief
Smush is a popular WordPress image optimization plugin used across thousands of websites. The plugin failed to properly restrict a network-wide configuration setting in WordPress multisite environments, allowing a site administrator to change the Hub Connector API key network-wide without network-level authorization. An attacker with this access can then remotely install and execute arbitrary plugins across all sites in the network, effectively taking complete control of the entire WordPress installation.
Technical details
The vulnerability is a privilege escalation combined with arbitrary code execution (CWE-94) in the Smush plugin before version 4.3.2. The root cause is improper access control on the `smush_sync_settings` AJAX action, which allows a single-site administrator to modify the `hub_connector_callback` setting that should only be changeable by network administrators. This setting stores the API key used for remote commands. Once an attacker sets their own API key network-wide, the Hub Connector endpoint accepts signed requests (HMAC-SHA256) from unauthenticated sources, allowing plugin installation and execution. The attack requires an existing site-level admin account on a multisite network where Smush is network-activated, but does not require network-admin rights. Patches are available in version 4.3.2 and later.
Affected products
- Wordfence Smush before 4.3.2
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory
- 2026-08-25: patched: Fixed in version 4.3.2