CVE-2026-110029 — Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment

CVE-2026-110029

Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment PUBLISHED

Description (CNA)

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.

Affected (CNA)

Vendor / product	Versions
Unknown / Squeeze	affected 0 before 1.8.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/be39621f-99f3-489f-aa54-f96ca92e167a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.