CVE-2026-110029CWE-862broken-access-control

CVE-2026-110029

Medium · published October 16, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00229 · 12.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-16T16:16Z
References (1)
https://wpscan.com/vulnerability/be39621f-99f3-489f-aa54-f96ca92e167a/ · [email protected]
EPSS history
Timeline
  • 18 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 16 OCT 11:08Z
    Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment
    cvelistv5
  • 16 OCT 11:08Z
    Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment
    cvelistv5