Smush – Lazy Load Images, Optimize & Compress Images <= 4.3.3 - Improper Certificate Validation to WPMU DEV API Key Exposure in Hub Connector
- ID
- WPSEC-2026-0236
- Plugin
- Smush – Image Optimization, Compression, Lazy Load, WebP & CDN (wp-smushit)
- Affected
- from 3.22.1 before 4.3.4
- Remediation
- Update to 4.3.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-295
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Smush – Lazy Load Images, Optimize & Compress Images on WPSec AttackSurface
- Fix released
- Published
Description
The Smush plugin for WordPress is vulnerable to improper certificate validation in versions 3.22.1 up to, and including, 4.3.3. The bundled WPMU DEV Hub Connector sent its API requests, including the scheduled twice-daily Hub sync, with TLS certificate verification disabled by default, and every authenticated request carried the site's WPMU DEV API key in the request body or Authorization header. This makes it possible for unauthenticated attackers in a privileged network position to intercept these requests through a man-in-the-middle attack and steal the API key, or to tamper with API responses. The API key is also the secret that authenticates Hub remote requests to the site, so a stolen key lets the attacker trigger remote actions such as activating or deactivating plugins and themes, or disconnecting the site. Only sites connected to the WPMU DEV Hub are affected.
References
- https://wpsec.com/vuln/WPSEC-2026-0236/
- https://plugins.svn.wordpress.org/wp-smushit/tags/4.3.4/
- https://wordpress.org/plugins/wp-smushit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS