CVE-2026-57720
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The ThumbPress WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 6.3.2.
Risk Assessment
An attacker can gain unauthorized access to administrative functions of the plugin, potentially leading to settings modification, data theft, or privilege escalation within the WordPress environment.
Recommendation
Immediately update the ThumbPress plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin until a patch is released.
Other vulnerabilities in ThumbPress
See all- CVE-2026-32549High
ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.
- CVE-2026-13432Medium
The ThumbPress WordPress plugin before version 6.2.2 lacks a capability check in one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the plugin, disrupting the site's image-handling functionality.
Original NVD description (English source)
Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a through 6.3.2.