CVE-2026-81285: Smush Image Compression DOS Vulnerability

CVE-2026-81285 Overview

CVE-2026-81285 is an unauthenticated denial of service vulnerability affecting the Smush Image Compression and Optimization WordPress plugin in versions up to and including 4.2.0. The flaw is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). Remote attackers can exhaust server resources without authentication, causing the WordPress site to become unavailable to legitimate users. Because the plugin is installed on a large number of WordPress sites for image optimization, the attack surface is broad. Availability is impacted, while confidentiality and integrity remain unaffected.

Critical Impact
An unauthenticated remote attacker can trigger resource exhaustion in the Smush plugin, rendering the affected WordPress site unavailable.

Affected Products

Smush Image Compression and Optimization WordPress plugin versions <= 4.2.0
WordPress installations running the vulnerable wp-smushit plugin
Sites permitting anonymous access to the affected plugin endpoints

Discovery Timeline

2026-08-28 - CVE-2026-81285 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-81285

Vulnerability Analysis

The vulnerability resides in the Smush Image Compression and Optimization plugin for WordPress. It maps to CWE-770, which describes software that allocates a reusable resource without properly restricting how much of the resource can be consumed. In this case, the plugin exposes functionality reachable over the network without authentication and without adequate rate limiting or size constraints.

An unauthenticated attacker sends crafted requests to the vulnerable endpoint. These requests cause the plugin to consume disproportionate amounts of CPU, memory, or I/O. When repeated at volume, the WordPress instance stops serving legitimate traffic. The attack requires no user interaction and no privileges.

Root Cause

The root cause is missing throttling and quota enforcement on plugin-handled operations. Image processing and optimization workflows are computationally expensive. When such workflows can be triggered anonymously without bounded input validation, an attacker can force the server to allocate resources until exhaustion. See the Patchstack advisory for vendor-supplied technical detail.

Attack Vector

The attack is fully remote. The attacker requires network reachability to the WordPress site and no credentials. Repeated requests to the vulnerable plugin endpoint saturate available worker processes, PHP memory, or backend storage. Public exploit code has not been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified proof-of-concept code is available.
// Refer to the Patchstack advisory for vendor technical details.

Detection Methods for CVE-2026-81285

Indicators of Compromise

Sudden spikes in PHP-FPM worker exhaustion or Apache/Nginx 5xx error rates targeting a WordPress host
Repeated anonymous HTTP requests to wp-smushit plugin endpoints from a small set of source IPs
Increased memory or CPU consumption on the WordPress server without a corresponding rise in legitimate traffic

Detection Strategies

Monitor web server access logs for high-volume unauthenticated requests referencing wp-smushit or smush paths
Alert when PHP process memory or execution time thresholds are exceeded on WordPress hosts
Correlate outbound 5xx responses with upstream request patterns to identify resource exhaustion conditions

Monitoring Recommendations

Enable rate-limit logging on the reverse proxy or web application firewall in front of WordPress
Track plugin version inventory across WordPress fleets to identify systems running Smush <= 4.2.0
Forward web server, PHP, and WordPress logs to a centralized log platform for correlation and retention

How to Mitigate CVE-2026-81285

Immediate Actions Required

Update the Smush Image Compression and Optimization plugin to a version later than 4.2.0 as soon as a fixed release is available from the vendor
Inventory all WordPress sites and confirm which run the vulnerable wp-smushit plugin
Place the affected sites behind a web application firewall with rate limiting enforced for plugin endpoints

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for current patch guidance and fixed version information. Apply the vendor update through the WordPress plugin manager or through automated deployment tooling.

Workarounds

Disable or deactivate the Smush plugin until a patched version is installed
Restrict access to the plugin's HTTP endpoints using web server rules or WAF policies
Enforce request rate limits and concurrent connection caps per source IP at the edge
Increase server-side timeouts monitoring to fail fast on abusive requests rather than exhausting worker pools

bash

# Example Nginx rate-limit configuration for the affected endpoints
limit_req_zone $binary_remote_addr zone=smush_zone:10m rate=5r/s;

location ~* /wp-content/plugins/wp-smushit/ {
    limit_req zone=smush_zone burst=10 nodelay;
    limit_req_status 429;
}