CVE-2026-13432
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The ThumbPress WordPress plugin before version 6.2.2 lacks a capability check in one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.
Risk Assessment
The risk is that unauthorized users can deactivate the plugin, potentially disrupting image handling on the site and affecting its functionality and user experience.
Recommendation
It is recommended to immediately update the ThumbPress plugin to version 6.2.2 or later, which includes a fix for the capability check in AJAX actions.
Other vulnerabilities in ThumbPress
See all- CVE-2026-32549High
ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.
- CVE-2026-57720Medium
The ThumbPress WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 6.3.2.
Original NVD description (English source)
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.