What is the CVSS score of EUVD-2026-41091?

EUVD-2026-41091 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

ThumbPress EUVD-2026-41091

| CVE-2026-57720 MEDIUM

Missing Authorization (CWE-862)

2026-07-01 audit@patchstack.com

GHSA-gr9v-q5xg-p963

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress endpoint, low-privilege account required, no confidentiality or integrity impact, only limited availability disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:43 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects ThumbPress: from n/a through 6.3.2.

AnalysisAI

Missing authorization in the ThumbPress WordPress plugin (Codexpert Inc) through version 6.3.2 allows low-privileged authenticated users to invoke restricted plugin functionality, resulting in limited availability impact against thumbnail or image-size management operations. The CVSS vector (PR:L, A:L) confirms exploitation requires an authenticated session but no elevated role, and produces no confidentiality or integrity loss - only partial disruption. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

ThumbPress is a WordPress plugin (slug: image-sizes) developed by Codexpert Inc that manages thumbnail regeneration and image size configurations for WordPress media. CWE-862 (Missing Authorization) indicates the plugin exposes one or more AJAX handlers, REST endpoints, or admin-page actions without verifying whether the calling user possesses the capability required to execute that action. In WordPress, this class of flaw commonly arises when a function is registered via wp_ajax_ (subscriber-accessible) but the corresponding nonce or capability check - such as current_user_can() - is absent or misconfigured. The affected surface is network-accessible because WordPress admin-ajax.php and REST routes are reachable over HTTP, placing attack vector at Network. The Patchstack advisory (referenced via NVD) categorizes this as a Broken Access Control vulnerability consistent with OWASP A01.

RemediationAI

The primary remediation is to update ThumbPress to a version beyond 6.3.2; however, no specific patched release version is confirmed in the available input data - the fix version should be verified against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/image-sizes/vulnerability/wordpress-thumbpress-plugin-6-3-2-broken-access-control-vulnerability and the WordPress plugin repository changelog before upgrading. If an update is not yet available or cannot be applied immediately, a compensating control is to restrict WordPress subscriber and contributor account creation and audit existing low-privilege accounts, since exploitation requires a valid authenticated session. Alternatively, a WAF rule can be configured to block unauthorized requests to the specific AJAX action or REST route identified in the Patchstack report. Deactivating the ThumbPress plugin entirely eliminates the attack surface at the cost of losing thumbnail management functionality. Site administrators should also review WordPress user roles to ensure no untrusted accounts hold even subscriber-level access.