CVE-2026-110029: 
WordPress vulnerability analysis and mitigation

CVE-2026-110029 is a Missing Authorization vulnerability in the Squeeze WordPress plugin that allows authenticated users with as low as Subscriber-level access to perform unauthorized file operations. Specifically, the plugin fails to perform a capability check on the squeeze_restore_attachment AJAX action, enabling any authenticated user to revert attachments to backup copies and permanently delete those backups and WebP derivatives regardless of ownership. All versions of the Squeeze plugin before 1.8.1 are affected. The vulnerability was publicly disclosed on October 15–16, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (WPScan, GitHub Advisory).

The root cause is CWE-862 (Missing Authorization): the plugin's AJAX handler for squeeze_restore_attachment does not verify whether the requesting user has sufficient privileges to perform the action. Because WordPress AJAX endpoints are accessible to any authenticated user by default, a Subscriber-level account can invoke this action against any attachment on the site, not just those they own. The vulnerability is network-exploitable with low attack complexity and requires no user interaction beyond authentication. A proof-of-concept is scheduled for public release on November 5, 2026, per WPScan's coordinated disclosure policy (WPScan, GitHub Advisory).

Successful exploitation allows any authenticated Subscriber-level user to revert any site attachment to its backup copy (potentially restoring older, undesired versions of media files) and to permanently delete backup files and WebP image derivatives generated by the plugin, regardless of who owns those files. This results in low integrity impact (unauthorized modification of attachment state) and low availability impact (permanent deletion of backup and derivative files), with no confidentiality impact. While the vulnerability does not enable remote code execution or data exfiltration, it could be used to disrupt site media content or destroy image optimization artifacts at scale (WPScan, GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time; WPScan has indicated the PoC will be released on November 5, 2026. The EPSS score is 0.0, reflecting very low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The NVD SSVC assessment classifies exploitation as "none" with partial technical impact and non-automatable attack (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Squeeze plugin in a version prior to 1.8.1 by checking plugin metadata (e.g., via /wp-content/plugins/squeeze/readme.txt) or using tools like WPScan.
2. Authentication: Register or obtain a Subscriber-level account on the target WordPress site (the lowest authenticated role).
3. Identify target attachment: Enumerate media library attachment IDs (e.g., by browsing the site or using the WordPress REST API at /wp-json/wp/v2/media) to find attachments with backups created by the Squeeze plugin.
4. Craft malicious AJAX request: Send an authenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to squeeze_restore_attachment and the target attachment ID, using the authenticated session cookie or nonce.
5. Achieve unauthorized file operation: The plugin processes the request without verifying ownership or capability, reverting the target attachment to its backup copy or permanently deleting the backup and WebP derivatives (WPScan).

• Network: Repeated POST requests to /wp-admin/admin-ajax.php with action=squeeze_restore_attachment from low-privilege user sessions; requests targeting attachment IDs not owned by the authenticated user.
• Logs: WordPress access logs showing admin-ajax.php POST requests from Subscriber-level accounts with the squeeze_restore_attachment action parameter; unexpected patterns of attachment restoration or deletion events in WordPress debug logs.
• File System: Missing or altered WebP derivative files in the WordPress uploads directory; disappearance of Squeeze plugin backup files (e.g., files with backup suffixes in wp-content/uploads/); unexpected restoration of older attachment versions.

Update the Squeeze WordPress plugin to version 1.8.1 or later, which introduces proper capability checks on the affected AJAX action. As a temporary workaround prior to patching, site administrators can restrict AJAX access to trusted roles via server-level rules or a Web Application Firewall (WAF) blocking requests to admin-ajax.php with the squeeze_restore_attachment action from non-administrator sessions. Reviewing and auditing all plugin AJAX actions for missing authorization checks is also recommended as a general hardening measure (WPScan, GitHub Advisory).

The vulnerability was discovered and reported by researcher Naoki Kawahigashi and verified by WPScan. No notable broader industry commentary, vendor statements beyond the patch release, or significant social media discussion has been identified at this time (WPScan).