The Smush WordPress plugin is vulnerable to arbitrary code execution, allowing site-level administrators to escalate privileges and compromise an entire multisite network.

This vulnerability involves improper control of code generation, categorized as CWE-94. It allows an authenticated user with administrative privileges on a single site within a WordPress multisite installation to perform unauthorized actions that affect the entire network.

A successful exploit grants an attacker the ability to execute arbitrary code across the entire multisite network, leading to a complete compromise of sensitive data, site integrity, and server availability. With a CVSS score of 7.2, this vulnerability represents a high-severity risk that could lead to full administrative takeover of the WordPress environment and significant reputational damage.

Immediate Action: Update the Smush plugin to version 4.3.2 or later immediately to resolve the improper access control flaw.

Proactive Monitoring: Review WordPress multisite audit logs for unusual configuration changes or unauthorized plugin setting modifications performed by site-level administrators.

Compensating Controls: If an immediate update is not feasible, restrict plugin management capabilities and monitor the installation for unexpected file changes or the execution of unauthorized background processes.

Public Exploit Available: No

Given the potential for full-network code execution, organizations utilizing Smush in a multisite configuration must prioritize patching to version 4.3.2. Organizations should evaluate their administrative access controls to ensure that only trusted individuals hold site-level administrative permissions until the update is applied.