{"affected":[{"defaultStatus":"unaffected","product":"Smush","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.3.6","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118241","cwes":["CWE-639"],"description":"The Smush  WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/150305f1-4cfc-46d2-9b90-b2f84e2e1d7e/"}],"kev":null,"metrics":[],"modifiedAt":1794376808494,"publishedAt":1794376808494,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/150305f1-4cfc-46d2-9b90-b2f84e2e1d7e/"}],"remediation":[],"revision":"602bd85c20319c81c417f5e6b2e1a424e14eb32c77596c43587db37fe32011b8","sources":[{"modifiedAt":1794376808494,"name":"CNA: WPScan","retrievedAt":1794377372671,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118241"}],"ssvc":null,"status":"published","title":"Smush < 4.3.6 - Author+ Optimization and Restoration of Others' Attachments via IDOR","updatedAt":1794377372671}