CVE-2026-118241

LowCVSS 2.7/10Last modified Nov 12, 2026

Description

The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1182428.5Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from renderinCVE-2026-1182435.3Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and stCVE-2026-1182447.2Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw marCVE-2026-1182458.6Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an uncheCVE-2026-1182468.4Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.stCVE-2026-1182476.9Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, HighchaCVE-2026-1182486.9Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions pCVE-2026-1182497.2Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point CVE-2026-1182507.2Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated seCVE-2026-1182518.4Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the winCVE-2026-1182528.4Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses componenCVE-2026-1182538.4Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen langu
CVE-2026-118241: Low severity, CVSS 2.7 | Vulnix