Manual Image Crop
Monthly
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.
Manual Image Crop WordPress plugin before version 1.15 exposes an authenticated AJAX crop action with neither capability check nor nonce verification, permitting any subscriber-level user to overwrite another user's media attachment thumbnails and corrupt stored image metadata across the entire Media Library. The flaw is simultaneously a broken authorization control and a CSRF vector - two distinct exploitation paths in one action. A public exploit exists per WPScan's disclosure, though EPSS at 0.10% (1st percentile) and SSVC's 'not automatable' rating indicate very limited observed exploitation, and no active exploitation is confirmed by CISA KEV.