EUVD-2026-45891
GHSA-3g6j-94vx-c8fv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
AJAX endpoint is network-reachable requiring only a subscriber account (PR:L); no confidentiality impact; scope unchanged as only the plugin itself is deactivated.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.
AnalysisAI
ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.
Technical ContextAI
ThumbPress is a WordPress plugin providing image thumbnail management functionality. The root cause is CWE-862 (Missing Authorization): an AJAX action handler executes a privileged operation - plugin deactivation - without first verifying that the requesting user holds sufficient WordPress capabilities (e.g., via current_user_can('activate_plugins')). In WordPress, AJAX actions registered without role-gating are accessible to any authenticated user by default, including subscribers, the lowest default role. The CPE identifier cpe:2.3:a:unknown:thumbpress:*:*:*:*:*:*:*:* covers all versions below 6.2.2, with the vendor field unresolved in NVD at time of analysis. The CVSS vector AV:N/AC:L/PR:L reflects the accessible, low-friction nature of AJAX-based WordPress exploitation.
RemediationAI
Update ThumbPress to version 6.2.2 or later, which introduces the missing capability check on the affected AJAX action. Site administrators should apply the update immediately via the WordPress admin panel (Plugins > Updates) or WP-CLI using wp plugin update thumbpress. Until the patch is applied, a practical compensating control is to disable open user registration (Settings > General > uncheck 'Anyone can register'), which eliminates the self-service subscriber account vector - though this will prevent new user signups, a trade-off to weigh against the site's purpose. Alternatively, a WAF rule blocking unauthenticated and low-privilege access to the specific AJAX action endpoint (wp-admin/admin-ajax.php with the relevant action parameter) can reduce exposure, though the specific action name would need to be confirmed from the WPScan advisory at https://wpscan.com/vulnerability/a408e8f9-4de7-4449-8fca-51ea46e4f433/.
More in Thumbpress
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today