CVE-2026-19223 Overview
CVE-2026-19223 affects the Smush WordPress plugin before version 4.3.2. The plugin fails to restrict a network-wide setting to network administrators. This allows an administrator of any single site on a WordPress multisite network to execute arbitrary code across the entire network. The flaw is a broken access control issue that enables horizontal and vertical privilege escalation across tenant boundaries in shared multisite deployments.
Critical Impact
A single-site administrator on a WordPress multisite network can execute arbitrary code across every site in the network, compromising all tenants hosted on the affected installation.
Affected Products
- Smush WordPress plugin versions before 4.3.2
- WordPress multisite networks running vulnerable Smush versions
- Shared hosting environments where the plugin is network-activated
Discovery Timeline
- 2026-08-27 - CVE-2026-19223 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-19223
Vulnerability Analysis
The Smush plugin exposes a setting intended to apply across an entire WordPress multisite network. On multisite installations, only Super Administrators (network administrators) should modify network-wide configuration. The plugin does not enforce this capability check. Any user with the site-level administrator role on any subsite can change the network setting. Because the setting influences behavior across every site in the network, the attacker gains code execution far outside the tenant boundary they were granted.
This maps to broken access control and privilege escalation. A tenant administrator, whose authority is scoped to a single site, escalates to network-wide arbitrary code execution.
Root Cause
The root cause is a missing authorization check on a privileged setting. The plugin verifies that the requester holds the administrator capability at the site level but does not verify manage_network_options or a comparable Super Admin capability. WordPress multisite exposes distinct capability tiers, and the plugin conflates them. Any handler that persists the network-wide value should call is_super_admin() or check manage_network_options before writing.
Attack Vector
An authenticated site administrator on any subsite submits a request to the setting endpoint exposed by the plugin. The plugin accepts the value and applies it network-wide. The attacker then leverages the modified setting to load or execute attacker-controlled code that runs in the context of the WordPress process across every site in the multisite network. This yields arbitrary code execution on the underlying web server for all tenants.
See the WPScan Vulnerability Details for the specific request handler and setting involved.
Detection Methods for CVE-2026-19223
Indicators of Compromise
- Unexpected modifications to Smush network-wide settings in wp_sitemeta or plugin-specific network options.
- New or modified PHP files under wp-content/ written by the web server user shortly after Smush setting changes.
- Site administrator accounts on subsites issuing POST requests to Smush admin endpoints referencing network settings.
- Outbound connections from the web server process to unfamiliar hosts following administrative activity on a subsite.
Detection Strategies
- Audit installed Smush plugin versions across all WordPress instances and flag any version below 4.3.2.
- Correlate WordPress activity logs with file integrity monitoring to identify setting changes followed by filesystem writes.
- Review admin-ajax and admin-post request logs for Smush endpoints invoked by non-Super Admin accounts.
Monitoring Recommendations
- Enable a WordPress activity log plugin that records network option changes and captures the acting user context.
- Monitor wp-content/uploads and plugin directories for unexpected .php file creation.
- Alert on PHP process spawning shell utilities such as sh, bash, curl, or wget.
How to Mitigate CVE-2026-19223
Immediate Actions Required
- Upgrade the Smush plugin to version 4.3.2 or later on every site and network in the environment.
- Audit subsite administrator accounts on multisite installations and remove unnecessary privileges.
- Review recent changes to Smush network-wide settings and revert any unauthorized modifications.
- Inspect the filesystem for web-shell artifacts if the vulnerable version was in use.
Patch Information
The vendor addressed the issue in Smush 4.3.2 by enforcing a Super Admin capability check on the network-wide setting. Refer to the WPScan Vulnerability Details for advisory information. Apply the update through the WordPress plugin manager or by deploying the updated plugin package to all sites in the multisite network.
Workarounds
- Network-deactivate the Smush plugin until the patched version is deployed.
- Restrict subsite administrator role assignments to trusted operators only.
- Place the WordPress admin surface behind an authenticated reverse proxy or IP allowlist to limit exposure.
# Verify installed Smush version across a multisite network
wp plugin get wp-smushit --field=version --allow-root
# Update Smush to the patched version
wp plugin update wp-smushit --version=4.3.2 --allow-root
# Network-deactivate as a temporary mitigation
wp plugin deactivate wp-smushit --network --allow-root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
