Thumbpress Compress Images Manage Thumbnails Detect Image Issues Webp Avif Lazy Loading Hotlinking More
Monthly
Any authenticated WordPress user holding only Subscriber-level access can remotely deactivate the ThumbPress plugin on versions 6.2.1 and earlier, because the send_deactivation_survey() handler registered to the wp_ajax_pl-plugin-deactivation action performs no capability check and no nonce verification. The impact is deliberately narrow - a low-privilege account can only turn the plugin off, with no path to data disclosure, code execution, or persistence - which aligns with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N score of 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to sites that actually allow low-privilege user registration; the upstream code change is visible in the public Trac changeset referenced by the advisory.
Any authenticated WordPress user holding only Subscriber-level access can remotely deactivate the ThumbPress plugin on versions 6.2.1 and earlier, because the send_deactivation_survey() handler registered to the wp_ajax_pl-plugin-deactivation action performs no capability check and no nonce verification. The impact is deliberately narrow - a low-privilege account can only turn the plugin off, with no path to data disclosure, code execution, or persistence - which aligns with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N score of 4.3. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is limited to sites that actually allow low-privilege user registration; the upstream code change is visible in the public Trac changeset referenced by the advisory.