An unauthenticated denial of service vulnerability in the Smush Image Compression and Optimization plugin permits remote attackers to exhaust system resources and degrade service availability.

The plugin fails to implement proper limits on resource allocation, allowing an unauthenticated remote attacker to trigger a denial of service condition by sending specifically crafted requests. This flaw originates from a failure to throttle or limit resource consumption during image processing tasks (CWE-770).

Successful exploitation of this vulnerability can result in significant service disruption, rendering the affected WordPress site unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw poses a direct risk to business continuity and operational uptime, as the attack requires no authentication and can be automated by remote actors.

Immediate Action: Update the Smush Image Compression and Optimization plugin to version 4.3.0 or the latest available release immediately to apply the necessary resource handling constraints.

Proactive Monitoring: Review server access logs for repeated, suspicious requests directed at the plugin endpoints and monitor system resource usage metrics for sudden spikes in CPU or memory consumption.

Compensating Controls: Implement rate limiting at the Web Application Firewall (WAF) level to block anomalous traffic patterns and excessive requests originating from single IP addresses.

Public Exploit Available: Unknown

Given the high CVSS score and the ease with which unauthenticated attackers can disrupt site operations, organizations should prioritize patching this plugin immediately. Administrators should verify that their instances are updated to version 4.3.0 or later to ensure the resource allocation flaw is effectively mitigated.