CVE-2026-19223: CWE-94 Improper Control of Generation of Code ('Code Injection') in Smush

The Smush WordPress plugin versions before 4.3.2 contain an improper control of code generation vulnerability (CWE-94). Specifically, the plugin does not restrict a network-wide setting to network administrators only, enabling an administrator of any single site within a multisite WordPress network to execute arbitrary code across the entire network. This vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An attacker with administrator privileges on any single site in a multisite WordPress network can execute arbitrary code across the entire network. This can lead to full compromise of all sites in the network, including data theft, site defacement, or denial of service.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator privileges carefully and monitor multisite network settings to prevent unauthorized code execution.