Description
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Smush | 3.22.1 – < 4.3.2 | 4.3.2 |
References
- https://wpscan.com/vulnerability/77187a44-9850-4b7e-a6c2-84de660f46a3/ exploit vdb-entry technical-description