The Smush WordPress plugin before version 4.3.4 allows a site administrator in a multisite network to modify a network‑wide access setting that is intended to be restricted to network administrators. This improper authorization can lead to unintended configuration changes across the entire network. Based on the description, it is inferred that such changes could violate policy, compromise data integrity, or disrupt operations.

WordPress sites that run Smush older than version 4.3.4 on a multisite installation are affected. Single‑site installations or sites using Smush 4.3.4 or newer are not impacted.

The vulnerability is exploitable by anyone with site‑level administrator rights, making the attack vector internal. The CVSS score of 2.7 indicates low severity, and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. However, because the change propagates to the entire network, based on the description, it is inferred that the potential impact may be significant, recommending timely patching.