Skip to main content

Thumbpress

2 CVEs product

Monthly

CVE-2026-32549 Aug 18, 13:59 HIGH PATCH This Week

Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.

WordPress Authentication Bypass Wordpress Plugin Thumbpress
NVD
CVSS 3.1
7.5
EPSS
0.4%
CVE-2026-13432 Jul 20, 06:00 MEDIUM POC PATCH This Month

ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.

WordPress Authentication Bypass Thumbpress Unknown
NVD WPScan VulDB
CVSS 3.1
5.4
EPSS
0.1%
EPSS 0% CVSS 7.5
HIGH PATCH This Week

Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.

WordPress Authentication Bypass Wordpress Plugin +1
NVD
EPSS 0% CVSS 5.4
MEDIUM POC PATCH This Month

ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.

WordPress Authentication Bypass Thumbpress +1
NVD WPScan VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy