CVE-2023-3352: Wpmudev Smush – Image Optimization, Compression, Lazy Load, WebP & Cdn

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.

Affected products

• Wpmudev Smush – Image Optimization, Compression, Lazy Load, WebP & Cdn: up to and including 3.16.4

Published 2024-06-21. Last modified 2026-06-17.