Thumbpress
Monthly
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.