CVE-2026-32549
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.
Risk Assessment
An attacker can modify settings or data they should not have access to, potentially leading to system integrity issues.
Recommendation
Upgrade ThumbPress to version 6.5 or later.
Other vulnerabilities in ThumbPress
See all- CVE-2026-7622Medium
The ThumbPress plugin for WordPress in versions up to and including 6.2.1 is vulnerable to unauthorized access due to missing capability checks and nonce verification in the send_deactivation_survey() function. An authenticated attacker with Subscriber-level access or higher can deactivate the ThumbPress plugin by sending a crafted POST request to admin-ajax.
- CVE-2026-13432Medium
The ThumbPress WordPress plugin before version 6.2.2 lacks a capability check in one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.
- CVE-2026-57720Medium
The ThumbPress WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 6.3.2.
Original NVD description (English source)
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS