CVE-2026-110029: CWE-862 Missing Authorization in Squeeze

CVE-2026-110029 is a missing authorization vulnerability (CWE-862) in the Squeeze WordPress plugin prior to version 1.8.1. The plugin fails to perform proper capability checks on a specific AJAX action, enabling authenticated users with low-level roles such as Subscriber to revert attachments to backup copies and delete those backups and related WebP derivatives permanently. This vulnerability affects all versions from 0 up to but not including 1.8.1.

An attacker with an authenticated Subscriber role can manipulate attachments by reverting them to backup copies and deleting those backups and associated WebP derivative images. This results in integrity and availability impacts on the affected attachments and their backups. Confidentiality is not impacted. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

A fixed version 1.8.1 or later should be applied to remediate this vulnerability. Since the affected versions are explicitly stated as all versions before 1.8.1, upgrading to 1.8.1 or newer is the recommended remediation. No vendor advisory is provided in the input, so patch status is inferred from the version range. Users should update the plugin promptly to prevent exploitation.