EUVD-2026-59910
GHSA-jv96-fx3j-whm2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Subscriber direct path needs no user interaction (UI:N); PR:L for required account; integrity-only impact with no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
AnalysisAI
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Direct exploitation via the authorization bypass requires only a valid WordPress account at subscriber level or above - no admin privileges, no media ownership, and no non-default site configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.7 (Medium) reflects network-accessible exploitation with low privilege and user interaction, yielding high integrity impact but no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The vendor has released a fix in Manual Image Crop version 1.15; site administrators should update the plugin immediately via the WordPress dashboard (Plugins > Installed Plugins > Update Available) or by downloading the patched version from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today