Now officially on WordPress.org

CVE Database / CVE-2023-3352

CVE · Medium

CVE-2023-3352 — Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.16.5

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2023-3352 Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.16.5 Missing Authorization Medium 4.3 < 3.16.5 3.16.5 2024-06-20 —

CVE-2023-3352

The Smush plugin for WordPress contains a capability check vulnerability in its delete_resmush_list() function that allows authenticated users with minimal permissions, including subscribers, to remove the resmush list for Nextgen or the Media Library. This flaw affects versions prior to 3.16.5 and could enable lower-privileged attackers to delete important optimization metadata without proper authorization.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings