---
id: CVE-2026-110039
title: Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
summary: >-
  The Smush  WordPress plugin before 4.3.4 does not restrict changes to a
  network-wide access setting to network administrators, allowing an
  administrator of a single site on a multisite network to change it for the
  entire network.
severity: none
cwe:
  - CWE-863
product: Smush
affected:
  - Smush < 4.3.4
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T06:00:15.049Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110039'
references:
  - url: 'https://wpscan.com/vulnerability/4f27b2fd-1b27-4274-85c5-f19e6998aa44/'
tags:
  - cve.org
ingestedAt: '2026-10-16T07:01:11.485Z'
---

## Overview

The Smush  WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.

## Affected

- `Smush < 4.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.